diff --git a/crates/oxc_angular_compiler/src/ast/html.rs b/crates/oxc_angular_compiler/src/ast/html.rs
index 4e9291ef8..88ff23db6 100644
--- a/crates/oxc_angular_compiler/src/ast/html.rs
+++ b/crates/oxc_angular_compiler/src/ast/html.rs
@@ -125,6 +125,9 @@ pub struct HtmlElement<'a> {
     /// Whether this is a void element (area, base, br, col, embed, hr, img, input, link, meta, param, source, track, wbr).
     /// Void elements cannot have content and do not have end tags.
     pub is_void: bool,
+    /// Parsed from a selectorless component tag (`<MyComp>`, `<MyComp:iframe>`).
+    /// The class is `name`; the host element is `component_prefix` / `component_tag_name`.
+    pub is_component: bool,
 }
 
 /// A selectorless component in the HTML AST.
@@ -518,6 +521,7 @@ mod tests {
             end_span: None,
             is_self_closing: false,
             is_void: false,
+            is_component: false,
         };
 
         let child2 = HtmlElement {
@@ -532,6 +536,7 @@ mod tests {
             end_span: None,
             is_self_closing: false,
             is_void: false,
+            is_component: false,
         };
 
         let mut children = Vec::new_in(&&allocator);
@@ -550,6 +555,7 @@ mod tests {
             end_span: None,
             is_self_closing: false,
             is_void: false,
+            is_component: false,
         };
 
         let mut nodes = Vec::new_in(&&allocator);
diff --git a/crates/oxc_angular_compiler/src/component/transform.rs b/crates/oxc_angular_compiler/src/component/transform.rs
index c6319bed2..981a40095 100644
--- a/crates/oxc_angular_compiler/src/component/transform.rs
+++ b/crates/oxc_angular_compiler/src/component/transform.rs
@@ -3701,8 +3701,10 @@ fn compile_component_full<'a>(
     };
 
     // Stage 2: Transform HTML to R3 AST
-    let r3_transform_options =
-        R3TransformOptions { collect_comment_nodes: parse_options.collect_comment_nodes };
+    let r3_transform_options = R3TransformOptions {
+        collect_comment_nodes: parse_options.collect_comment_nodes,
+        angular_version: options.angular_version,
+    };
     let transformer = HtmlToR3Transform::new(allocator, template, r3_transform_options);
     let r3_result = transformer.transform(nodes);
 
@@ -4161,8 +4163,10 @@ pub fn compile_component_template<'a>(
     };
 
     // Stage 2: Transform HTML to R3 AST
-    let r3_transform_options =
-        R3TransformOptions { collect_comment_nodes: parse_options.collect_comment_nodes };
+    let r3_transform_options = R3TransformOptions {
+        collect_comment_nodes: parse_options.collect_comment_nodes,
+        angular_version: None,
+    };
     let transformer = HtmlToR3Transform::new(allocator, template, r3_transform_options);
     let r3_result = transformer.transform(nodes);
 
@@ -4258,8 +4262,10 @@ pub fn compile_template_to_js_with_options<'a>(
     };
 
     // Stage 2: Transform HTML to R3 AST
-    let r3_transform_options =
-        R3TransformOptions { collect_comment_nodes: parse_options.collect_comment_nodes };
+    let r3_transform_options = R3TransformOptions {
+        collect_comment_nodes: parse_options.collect_comment_nodes,
+        angular_version: options.angular_version,
+    };
     let transformer = HtmlToR3Transform::new(allocator, template, r3_transform_options);
     let r3_result = transformer.transform(nodes);
 
@@ -4433,8 +4439,10 @@ pub fn compile_template_for_hmr<'a>(
     };
 
     // Stage 2: Transform HTML to R3 AST
-    let r3_transform_options =
-        R3TransformOptions { collect_comment_nodes: parse_options.collect_comment_nodes };
+    let r3_transform_options = R3TransformOptions {
+        collect_comment_nodes: parse_options.collect_comment_nodes,
+        angular_version: options.angular_version,
+    };
     let transformer = HtmlToR3Transform::new(allocator, template, r3_transform_options);
     let r3_result = transformer.transform(nodes);
 
@@ -5132,8 +5140,10 @@ pub fn compile_template_for_linker<'a>(
     };
 
     // Stage 2: Transform HTML to R3 AST
-    let r3_transform_options =
-        R3TransformOptions { collect_comment_nodes: parse_options.collect_comment_nodes };
+    let r3_transform_options = R3TransformOptions {
+        collect_comment_nodes: parse_options.collect_comment_nodes,
+        angular_version: None,
+    };
     let transformer = HtmlToR3Transform::new(allocator, template, r3_transform_options);
     let r3_result = transformer.transform(nodes);
 
diff --git a/crates/oxc_angular_compiler/src/directive/compiler.rs b/crates/oxc_angular_compiler/src/directive/compiler.rs
index 7df853a01..1e43842b0 100644
--- a/crates/oxc_angular_compiler/src/directive/compiler.rs
+++ b/crates/oxc_angular_compiler/src/directive/compiler.rs
@@ -30,7 +30,7 @@ use crate::output::ast::{
 };
 use crate::parser::expression::BindingParser;
 use crate::pipeline::emit::{HostBindingCompilationResult, compile_host_bindings};
-use crate::pipeline::ingest::{HostBindingInput, ingest_host_binding};
+use crate::pipeline::ingest::{HostBindingInput, ingest_host_binding_with_version};
 use crate::pipeline::selector::{
     parse_selector_to_r3_selector as parse_css_to_r3, r3_selector_to_output_expr,
 };
@@ -163,9 +163,12 @@ fn build_base_directive_fields<'a>(
     // - hostVars: number of host variables (only if > 0)
     // - hostBindings: the host binding function
     if metadata.host.has_bindings() {
-        if let Some((result, new_pool_index)) =
-            compile_directive_host_bindings(allocator, metadata, pool_starting_index)
-        {
+        if let Some((result, new_pool_index)) = compile_directive_host_bindings(
+            allocator,
+            metadata,
+            pool_starting_index,
+            angular_version,
+        ) {
             next_pool_index = new_pool_index;
 
             // hostAttrs: [...] - static host attributes
@@ -562,6 +565,7 @@ fn compile_directive_host_bindings<'a>(
     allocator: &'a Allocator,
     metadata: &R3DirectiveMetadata<'a>,
     pool_starting_index: u32,
+    angular_version: Option<crate::AngularVersion>,
 ) -> Option<(HostBindingCompilationResult<'a>, u32)> {
     let host = &metadata.host;
 
@@ -580,7 +584,13 @@ fn compile_directive_host_bindings<'a>(
 
     // Ingest and compile the host bindings using the IR pipeline
     // Use the provided pool_starting_index to continue from where previous compilations left off
-    let mut job = ingest_host_binding(allocator, input, pool_starting_index);
+    let mut job = ingest_host_binding_with_version(
+        allocator,
+        input,
+        pool_starting_index,
+        angular_version,
+        None,
+    );
     let result = compile_host_bindings(&mut job);
 
     // Get the next pool index after host binding compilation
diff --git a/crates/oxc_angular_compiler/src/i18n/extractor_merger.rs b/crates/oxc_angular_compiler/src/i18n/extractor_merger.rs
index 3a143e4aa..bbc47e74a 100644
--- a/crates/oxc_angular_compiler/src/i18n/extractor_merger.rs
+++ b/crates/oxc_angular_compiler/src/i18n/extractor_merger.rs
@@ -17,6 +17,7 @@ use crate::i18n::ast::{
 };
 use crate::i18n::parser::{I18nMessageFactory, create_i18n_message_factory};
 use crate::i18n::translation_bundle::TranslationBundle;
+use crate::schema::is_trusted_types_sink_at;
 use crate::util::{ParseSourceFile, ParseSourceSpan};
 
 // ============================================================================
@@ -367,18 +368,22 @@ enum VisitorMode {
 /// * `implicit_tags` - Tag names that are implicitly translatable.
 /// * `implicit_attrs` - Attribute names that are implicitly translatable per element.
 /// * `preserve_significant_whitespace` - Whether to preserve significant whitespace.
+/// * `angular_version` - The Angular version being targeted; gates which
+///   Trusted Types sinks reject translation.
 pub fn extract_messages(
     nodes: &[HtmlNodeRef<'_>],
     implicit_tags: &[String],
     implicit_attrs: &FxHashMap<String, Vec<String>>,
     preserve_significant_whitespace: bool,
     source_file: Arc<ParseSourceFile>,
+    angular_version: Option<crate::AngularVersion>,
 ) -> ExtractionResult {
     let mut visitor = I18nVisitor::new(
         implicit_tags,
         implicit_attrs,
         preserve_significant_whitespace,
         source_file,
+        angular_version,
     );
     visitor.extract(nodes)
 }
@@ -390,14 +395,18 @@ pub fn extract_messages(
 /// * `translations` - The translation bundle.
 /// * `implicit_tags` - Tag names that are implicitly translatable.
 /// * `implicit_attrs` - Attribute names that are implicitly translatable per element.
+/// * `angular_version` - The Angular version being targeted; gates which
+///   Trusted Types sinks reject translation.
 pub fn merge_translations(
     nodes: &[HtmlNodeRef<'_>],
     translations: &TranslationBundle,
     implicit_tags: &[String],
     implicit_attrs: &FxHashMap<String, Vec<String>>,
     source_file: Arc<ParseSourceFile>,
+    angular_version: Option<crate::AngularVersion>,
 ) -> MergeResult {
-    let mut visitor = I18nVisitor::new(implicit_tags, implicit_attrs, true, source_file);
+    let mut visitor =
+        I18nVisitor::new(implicit_tags, implicit_attrs, true, source_file, angular_version);
     visitor.merge(nodes, translations)
 }
 
@@ -567,6 +576,9 @@ struct I18nVisitor<'a> {
     translations: Option<&'a TranslationBundle>,
     /// Source file for span conversion.
     source_file: Arc<ParseSourceFile>,
+    /// The Angular version being targeted; gates which Trusted Types sinks
+    /// reject translation.
+    angular_version: Option<crate::AngularVersion>,
 }
 
 impl<'a> I18nVisitor<'a> {
@@ -580,6 +592,7 @@ impl<'a> I18nVisitor<'a> {
         implicit_attrs: &'a FxHashMap<String, Vec<String>>,
         preserve_significant_whitespace: bool,
         source_file: Arc<ParseSourceFile>,
+        angular_version: Option<crate::AngularVersion>,
     ) -> Self {
         Self {
             implicit_tags,
@@ -603,6 +616,7 @@ impl<'a> I18nVisitor<'a> {
             ),
             translations: None,
             source_file,
+            angular_version,
         }
     }
 
@@ -1083,7 +1097,7 @@ impl<'a> I18nVisitor<'a> {
 
     /// Translates attributes for merge mode, handling i18n-* attributes.
     fn translate_attributes_for_merge(
-        &self,
+        &mut self,
         element_name: &str,
         attrs: &[HtmlAttrRef<'_>],
     ) -> Vec<TranslatedAttribute> {
@@ -1095,6 +1109,15 @@ impl<'a> I18nVisitor<'a> {
         for attr in attrs {
             if attr.name.starts_with(I18N_ATTR_PREFIX) {
                 let target_name = &attr.name[I18N_ATTR_PREFIX.len()..];
+                if is_trusted_types_sink_at(element_name, target_name, self.angular_version) {
+                    self.report_error(
+                        attr.span,
+                        &format!(
+                            "Translating attribute '{target_name}' is disallowed for security reasons."
+                        ),
+                    );
+                    continue;
+                }
                 explicit_attr_meta.insert(target_name.to_string(), attr.value.to_string());
             }
         }
@@ -1109,8 +1132,29 @@ impl<'a> I18nVisitor<'a> {
 
                 // Check if this attribute needs translation
                 let i18n_meta = explicit_attr_meta.get(attr.name);
-                let needs_translation =
-                    i18n_meta.is_some() || implicit_attr_names.iter().any(|n| n == attr.name);
+                let implicit = implicit_attr_names.iter().any(|n| n == attr.name);
+                let needs_translation = i18n_meta.is_some() || implicit;
+
+                // Implicit config can name a sink (`iframe` → `src`) without an
+                // `i18n-*` marker. The marker loop above never sees that case.
+                if needs_translation
+                    && is_trusted_types_sink_at(element_name, attr.name, self.angular_version)
+                {
+                    if implicit && i18n_meta.is_none() {
+                        self.report_error(
+                            attr.span,
+                            &format!(
+                                "Translating attribute '{}' is disallowed for security reasons.",
+                                attr.name
+                            ),
+                        );
+                    }
+                    return Some(TranslatedAttribute {
+                        name: attr.name.to_string(),
+                        value: attr.value.to_string(),
+                        span: attr.span,
+                    });
+                }
 
                 if needs_translation && !attr.is_interpolation_only && !attr.value.trim().is_empty()
                 {
@@ -1235,10 +1279,20 @@ impl<'a> I18nVisitor<'a> {
         let implicit_attr_names =
             self.implicit_attrs.get(element_name).cloned().unwrap_or_default();
 
-        // Collect explicit i18n-* attributes
+        // Collect explicit i18n-* attributes. Trusted Types sinks are rejected
+        // and not extracted (`i18n/meta.ts`).
         for attr in attrs {
             if attr.name.starts_with(I18N_ATTR_PREFIX) {
                 let target_name = &attr.name[I18N_ATTR_PREFIX.len()..];
+                if is_trusted_types_sink_at(element_name, target_name, self.angular_version) {
+                    self.report_error(
+                        attr.span,
+                        &format!(
+                            "Translating attribute '{target_name}' is disallowed for security reasons."
+                        ),
+                    );
+                    continue;
+                }
                 explicit_attr_names.insert(target_name.to_string(), attr.value.to_string());
             }
         }
@@ -1254,13 +1308,23 @@ impl<'a> I18nVisitor<'a> {
                     attr.is_interpolation_only,
                 );
             } else if implicit_attr_names.iter().any(|n| n == attr.name) {
-                self.add_message_from_attr(
-                    attr.name,
-                    attr.value,
-                    "",
-                    attr.span,
-                    attr.is_interpolation_only,
-                );
+                if is_trusted_types_sink_at(element_name, attr.name, self.angular_version) {
+                    self.report_error(
+                        attr.span,
+                        &format!(
+                            "Translating attribute '{}' is disallowed for security reasons.",
+                            attr.name
+                        ),
+                    );
+                } else {
+                    self.add_message_from_attr(
+                        attr.name,
+                        attr.value,
+                        "",
+                        attr.span,
+                        attr.is_interpolation_only,
+                    );
+                }
             }
         }
     }
@@ -1789,9 +1853,196 @@ mod tests {
     #[test]
     fn test_extract_messages_empty() {
         let source_file = Arc::new(ParseSourceFile::new("", "<test>"));
-        let result = extract_messages(&[], &[], &FxHashMap::default(), true, source_file);
+        let result = extract_messages(&[], &[], &FxHashMap::default(), true, source_file, None);
+        assert!(result.messages.is_empty());
+        assert!(result.errors.is_empty());
+    }
+
+    #[test]
+    fn test_iframe_src_i18n_is_rejected() {
+        let source_file = Arc::new(ParseSourceFile::new("", "<test>"));
+        let span = Span::default();
+        let nodes = vec![HtmlNodeRef::Element {
+            name: "iframe",
+            attrs: vec![
+                HtmlAttrRef {
+                    name: "i18n-src",
+                    value: "translated url",
+                    span,
+                    is_interpolation_only: false,
+                },
+                HtmlAttrRef {
+                    name: "src",
+                    value: "https://example.com",
+                    span,
+                    is_interpolation_only: false,
+                },
+            ],
+            children: vec![],
+            span,
+            start_span: span,
+            end_span: None,
+        }];
+        let result = extract_messages(&nodes, &[], &FxHashMap::default(), true, source_file, None);
         assert!(result.messages.is_empty());
+        assert!(result.errors.iter().any(|err| err.message.contains("disallowed")));
+    }
+
+    #[test]
+    fn test_plain_title_i18n_is_still_extracted() {
+        let source_file = Arc::new(ParseSourceFile::new("", "<test>"));
+        let span = Span::default();
+        let nodes = vec![HtmlNodeRef::Element {
+            name: "div",
+            attrs: vec![
+                HtmlAttrRef {
+                    name: "i18n-title",
+                    value: "meaning|desc",
+                    span,
+                    is_interpolation_only: false,
+                },
+                HtmlAttrRef { name: "title", value: "Hello", span, is_interpolation_only: false },
+            ],
+            children: vec![],
+            span,
+            start_span: span,
+            end_span: None,
+        }];
+        let result = extract_messages(&nodes, &[], &FxHashMap::default(), true, source_file, None);
         assert!(result.errors.is_empty());
+        assert!(!result.messages.is_empty());
+    }
+
+    #[test]
+    fn test_implicit_iframe_src_is_rejected() {
+        let source_file = Arc::new(ParseSourceFile::new("", "<test>"));
+        let span = Span::default();
+        let mut implicit_attrs = FxHashMap::default();
+        implicit_attrs.insert("iframe".to_string(), vec!["src".to_string()]);
+        let nodes = vec![HtmlNodeRef::Element {
+            name: "iframe",
+            attrs: vec![HtmlAttrRef {
+                name: "src",
+                value: "https://example.com",
+                span,
+                is_interpolation_only: false,
+            }],
+            children: vec![],
+            span,
+            start_span: span,
+            end_span: None,
+        }];
+        let result = extract_messages(&nodes, &[], &implicit_attrs, true, source_file, None);
+        assert!(result.messages.is_empty());
+        assert!(result.errors.iter().any(|err| err.message.contains("disallowed")));
+    }
+
+    #[test]
+    fn test_implicit_iframe_src_is_not_rewritten_on_merge() {
+        let source_file = Arc::new(ParseSourceFile::new("", "<test>"));
+        let span = Span::default();
+        let mut implicit_attrs = FxHashMap::default();
+        implicit_attrs.insert("iframe".to_string(), vec!["src".to_string()]);
+        let nodes = vec![HtmlNodeRef::Element {
+            name: "iframe",
+            attrs: vec![HtmlAttrRef {
+                name: "src",
+                value: "https://example.com",
+                span,
+                is_interpolation_only: false,
+            }],
+            children: vec![],
+            span,
+            start_span: span,
+            end_span: None,
+        }];
+        let bundle = crate::i18n::translation_bundle::TranslationBundle::new_empty(
+            crate::i18n::digest::compute_digest,
+            crate::i18n::i18n_html_parser::MissingTranslationStrategy::Ignore,
+            None,
+        );
+        let result = merge_translations(&nodes, &bundle, &[], &implicit_attrs, source_file, None);
+        assert!(result.errors.iter().any(|err| err.message.contains("disallowed")));
+        match &result.nodes[0] {
+            TranslatedNode::Element { attrs, .. } => {
+                assert_eq!(attrs[0].name, "src");
+                assert_eq!(attrs[0].value, "https://example.com");
+            }
+            _ => panic!("expected an element"),
+        }
+    }
+
+    #[test]
+    fn test_iframe_src_i18n_allowed_before_21_2_4() {
+        // `iframe|src` joined the Trusted Types sinks at 21.2.4; standalone
+        // extraction and merge must follow the same cutoff as compilation.
+        let span = Span::default();
+        let nodes = || {
+            vec![HtmlNodeRef::Element {
+                name: "iframe",
+                attrs: vec![
+                    HtmlAttrRef {
+                        name: "i18n-src",
+                        value: "translated url",
+                        span,
+                        is_interpolation_only: false,
+                    },
+                    HtmlAttrRef {
+                        name: "src",
+                        value: "https://example.com",
+                        span,
+                        is_interpolation_only: false,
+                    },
+                ],
+                children: vec![],
+                span,
+                start_span: span,
+                end_span: None,
+            }]
+        };
+
+        let allowed = extract_messages(
+            &nodes(),
+            &[],
+            &FxHashMap::default(),
+            true,
+            Arc::new(ParseSourceFile::new("", "<test>")),
+            Some(crate::AngularVersion::new(21, 2, 3)),
+        );
+        assert!(allowed.errors.is_empty(), "{:?}", allowed.errors);
+        assert!(!allowed.messages.is_empty());
+
+        let rejected = extract_messages(
+            &nodes(),
+            &[],
+            &FxHashMap::default(),
+            true,
+            Arc::new(ParseSourceFile::new("", "<test>")),
+            Some(crate::AngularVersion::new(21, 2, 4)),
+        );
+        assert!(rejected.messages.is_empty());
+        assert!(rejected.errors.iter().any(|err| err.message.contains("disallowed")));
+
+        // Merge follows the same cutoff: on 21.2.3 the i18n-src marker is
+        // collected and the attribute is translatable.
+        let bundle = crate::i18n::translation_bundle::TranslationBundle::new_empty(
+            crate::i18n::digest::compute_digest,
+            crate::i18n::i18n_html_parser::MissingTranslationStrategy::Ignore,
+            None,
+        );
+        let merged = merge_translations(
+            &nodes(),
+            &bundle,
+            &[],
+            &FxHashMap::default(),
+            Arc::new(ParseSourceFile::new("", "<test>")),
+            Some(crate::AngularVersion::new(21, 2, 3)),
+        );
+        assert!(
+            !merged.errors.iter().any(|err| err.message.contains("disallowed")),
+            "{:?}",
+            merged.errors
+        );
     }
 
     #[test]
diff --git a/crates/oxc_angular_compiler/src/parser/html/parser.rs b/crates/oxc_angular_compiler/src/parser/html/parser.rs
index 161c12742..c23f79f21 100644
--- a/crates/oxc_angular_compiler/src/parser/html/parser.rs
+++ b/crates/oxc_angular_compiler/src/parser/html/parser.rs
@@ -227,6 +227,7 @@ impl<'a> HtmlParser<'a> {
                             name: Ident::from(""),
                             component_prefix: None,
                             component_tag_name: None,
+                            is_component: false,
                             attrs: Vec::new_in(&self.allocator),
                             directives: Vec::new_in(&self.allocator),
                             children: Vec::new_in(&self.allocator),
@@ -376,6 +377,7 @@ impl<'a> HtmlParser<'a> {
                             name: Ident::from(""),
                             component_prefix: None,
                             component_tag_name: None,
+                            is_component: false,
                             attrs: Vec::new_in(&self.allocator),
                             directives: Vec::new_in(&self.allocator),
                             children: Vec::new_in(&self.allocator),
@@ -421,6 +423,7 @@ impl<'a> HtmlParser<'a> {
                 name: Ident::from(""),
                 component_prefix: None,
                 component_tag_name: None,
+                is_component: false,
                 attrs: Vec::new_in(&self.allocator),
                 directives: Vec::new_in(&self.allocator),
                 children: Vec::new_in(&self.allocator),
@@ -568,10 +571,11 @@ impl<'a> HtmlParser<'a> {
             return; // No token to consume
         };
         let start = start_token.start;
+        let is_component = start_token.token_type == HtmlTokenType::ComponentOpenStart;
         // TagOpenStart has parts [prefix, name]
         // ComponentOpenStart has parts [component_name, prefix, tag_name]
         let (tag_name, local_name, has_ns_prefix, component_prefix, component_tag_name) =
-            if start_token.token_type == HtmlTokenType::ComponentOpenStart {
+            if is_component {
                 // For components, extract all three parts:
                 // parts[0] = component_name, parts[1] = prefix, parts[2] = tag_name
                 let component_name = start_token.parts.first().cloned().unwrap_or_default();
@@ -656,6 +660,7 @@ impl<'a> HtmlParser<'a> {
             name: Ident::from_in(tag_name.clone(), &self.allocator),
             component_prefix: component_prefix.map(|p| Ident::from_in(p, &self.allocator)),
             component_tag_name: component_tag_name.map(|t| Ident::from_in(t, &self.allocator)),
+            is_component,
             attrs,
             directives,
             children: Vec::new_in(&self.allocator),
@@ -1148,6 +1153,7 @@ impl<'a> HtmlParser<'a> {
             name: Ident::from_in(tag_name.clone(), &self.allocator),
             component_prefix: None,
             component_tag_name: None,
+            is_component: false,
             attrs: Vec::new_in(&self.allocator),
             directives: Vec::new_in(&self.allocator),
             children: Vec::new_in(&self.allocator),
@@ -1461,6 +1467,7 @@ impl<'a> HtmlParser<'a> {
                             name: Ident::from(""),
                             component_prefix: None,
                             component_tag_name: None,
+                            is_component: false,
                             attrs: Vec::new_in(&self.allocator),
                             directives: Vec::new_in(&self.allocator),
                             children: Vec::new_in(&self.allocator),
diff --git a/crates/oxc_angular_compiler/src/parser/html/whitespace.rs b/crates/oxc_angular_compiler/src/parser/html/whitespace.rs
index bcb4025d7..2640b286d 100644
--- a/crates/oxc_angular_compiler/src/parser/html/whitespace.rs
+++ b/crates/oxc_angular_compiler/src/parser/html/whitespace.rs
@@ -370,6 +370,7 @@ impl<'a> WhitespaceVisitor<'a> {
             name: el.name.clone(),
             component_prefix: el.component_prefix.clone(),
             component_tag_name: el.component_tag_name.clone(),
+            is_component: el.is_component,
             attrs: self.clone_attributes(&el.attrs),
             directives: self.clone_directives(&el.directives),
             children: self.clone_children(&el.children),
@@ -563,6 +564,7 @@ impl<'a> WhitespaceVisitor<'a> {
                     name: element.name.clone(),
                     component_prefix: element.component_prefix.clone(),
                     component_tag_name: element.component_tag_name.clone(),
+                    is_component: element.is_component,
                     attrs,
                     directives: self.clone_directives(&element.directives),
                     children: self.clone_children(&element.children),
@@ -584,6 +586,7 @@ impl<'a> WhitespaceVisitor<'a> {
                 name: element.name.clone(),
                 component_prefix: element.component_prefix.clone(),
                 component_tag_name: element.component_tag_name.clone(),
+                is_component: element.is_component,
                 attrs: self.clone_attributes(&element.attrs),
                 directives: self.clone_directives(&element.directives),
                 children,
diff --git a/crates/oxc_angular_compiler/src/pipeline/ingest.rs b/crates/oxc_angular_compiler/src/pipeline/ingest.rs
index 22c9955af..2e920a755 100644
--- a/crates/oxc_angular_compiler/src/pipeline/ingest.rs
+++ b/crates/oxc_angular_compiler/src/pipeline/ingest.rs
@@ -4122,7 +4122,18 @@ fn ingest_host_dom_property<'a>(
         name,
         expression,
         unit: property.unit,
-        security_context: property.security_context,
+        // Host property bindings recompute the context from the selector.
+        // `style` / `class` / animation ops are specialized before sanitizers run.
+        security_context: match binding_kind {
+            BindingKind::Attribute | BindingKind::Property | BindingKind::TwoWayProperty => {
+                crate::schema::host_binding_security_context_for(
+                    job.component_selector.as_str(),
+                    name.as_str(),
+                    job.angular_version,
+                )
+            }
+            _ => SecurityContext::None,
+        },
         i18n_message: None,
         is_text_attribute: false,
     });
@@ -4130,58 +4141,15 @@ fn ingest_host_dom_property<'a>(
     job.root.update.push(op);
 }
 
-/// Computes the security context for an attribute binding.
-///
-/// This is a simplified implementation of Angular's `calcPossibleSecurityContexts`
-/// that handles the most common cases based on element and property names.
-///
-/// Ported from Angular's `binding_parser.ts` and `dom_security_schema.ts`.
-fn compute_security_context(selector: &str, attr_name: &str) -> SecurityContext {
-    use crate::schema::{calc_security_context_for_unknown_element, get_security_context};
-
-    // Extract element name from selector if present (e.g., "a[myDirective]" → "a")
-    let element = extract_element_from_selector(selector);
-
-    match element {
-        Some(element_name) => {
-            // Element is known - use the specific lookup
-            get_security_context(&element_name, attr_name)
-        }
-        None => {
-            // Element is unknown (e.g., attribute-only directive like [myDirective])
-            // Use the ambiguous lookup that checks all possible elements
-            calc_security_context_for_unknown_element(attr_name)
-        }
-    }
-}
-
-/// Extracts the element name from a CSS selector.
+/// Security context for a static host attribute.
 ///
-/// Examples:
-/// - "a[myDirective]" → Some("a")
-/// - "div.my-class" → Some("div")
-/// - "[myDirective]" → None
-/// - ".my-class" → None
-fn extract_element_from_selector(selector: &str) -> Option<String> {
-    // Skip leading whitespace
-    let s = selector.trim();
-
-    // If starts with [, ., or :, there's no element
-    if s.starts_with('[') || s.starts_with('.') || s.starts_with(':') || s.starts_with('#') {
-        return None;
-    }
-
-    // Find the element name (alphanumeric and hyphens until a special char)
-    let mut element_end = 0;
-    for (i, c) in s.char_indices() {
-        if c.is_alphanumeric() || c == '-' || c == '_' {
-            element_end = i + c.len_utf8();
-        } else {
-            break;
-        }
-    }
-
-    if element_end > 0 { Some(s[..element_end].to_lowercase()) } else { None }
+/// Same selector rules as host property bindings (`calcPossibleSecurityContexts`).
+fn compute_security_context(
+    selector: &str,
+    attr_name: &str,
+    version: Option<crate::AngularVersion>,
+) -> SecurityContext {
+    crate::schema::host_binding_security_context_for(selector, attr_name, version)
 }
 
 /// Ingests a static host attribute.
@@ -4202,7 +4170,11 @@ fn ingest_host_attribute<'a>(
     let allocator = job.allocator;
 
     // Compute security context based on selector and attribute name
-    let security_context = compute_security_context(job.component_selector.as_str(), name.as_str());
+    let security_context = compute_security_context(
+        job.component_selector.as_str(),
+        name.as_str(),
+        job.angular_version,
+    );
 
     // Wrap the OutputExpression in IrExpression::OutputExpr
     // This matches TypeScript which passes o.Expression directly to the IR
@@ -4442,7 +4414,11 @@ fn ingest_control_flow_insertion_point<'a, 'b>(
             continue;
         }
 
-        let security_context = crate::schema::get_security_context(NG_TEMPLATE_TAG_NAME, attr_name);
+        let security_context = crate::schema::get_security_context_for(
+            NG_TEMPLATE_TAG_NAME,
+            attr_name,
+            job.angular_version,
+        );
         let value_expr = create_string_literal_atom(allocator, attr.value.clone());
 
         // Handle i18n message if present (for i18n-* attribute markers)
@@ -4531,8 +4507,11 @@ fn ingest_control_flow_insertion_point<'a, 'b>(
             continue;
         }
 
-        let security_context =
-            crate::schema::get_security_context(NG_TEMPLATE_TAG_NAME, &input.name);
+        let security_context = crate::schema::get_security_context_for(
+            NG_TEMPLATE_TAG_NAME,
+            &input.name,
+            job.angular_version,
+        );
 
         let extracted_attr_op = CreateOp::ExtractedAttribute(ExtractedAttributeOp {
             base: CreateOpBase { source_span: Some(input.source_span), ..Default::default() },
diff --git a/crates/oxc_angular_compiler/src/pipeline/phases/resolve_sanitizers.rs b/crates/oxc_angular_compiler/src/pipeline/phases/resolve_sanitizers.rs
index 2b56aac97..3848d7174 100644
--- a/crates/oxc_angular_compiler/src/pipeline/phases/resolve_sanitizers.rs
+++ b/crates/oxc_angular_compiler/src/pipeline/phases/resolve_sanitizers.rs
@@ -7,11 +7,13 @@
 //! Ported from Angular's `template/pipeline/src/phases/resolve_sanitizers.ts`.
 
 use oxc_str::Ident;
+use rustc_hash::FxHashMap;
 
 use crate::ast::r3::SecurityContext;
-use crate::ir::ops::{CreateOp, UpdateOp};
+use crate::ir::ops::{CreateOp, UpdateOp, XrefId};
 use crate::pipeline::compilation::{ComponentCompilationJob, HostBindingCompilationJob};
 use crate::r3::Identifiers;
+use crate::schema::{is_iframe_security_sensitive_attr, uses_iframe_attr_validation};
 
 /// Map a security context to its sanitizer function name.
 fn get_sanitizer_fn(security_context: SecurityContext) -> Option<&'static str> {
@@ -27,10 +29,8 @@ fn get_sanitizer_fn(security_context: SecurityContext) -> Option<&'static str> {
         // selects the actual sanitizer at runtime based on the tag name.
         SecurityContext::UrlOrResourceUrl => Some(Identifiers::SANITIZE_URL_OR_RESOURCE_URL),
         SecurityContext::None => None,
-        // AttributeNoBinding means the attribute should not be bound at all.
-        // This should produce a compile-time error in the HTML-to-R3 transform.
-        // For now, return None but the binding should have been rejected earlier.
-        SecurityContext::AttributeNoBinding => None,
+        // `resolve_sanitizers.ts` maps ATTRIBUTE_NO_BINDING to `ɵɵvalidateAttribute`.
+        SecurityContext::AttributeNoBinding => Some(Identifiers::VALIDATE_ATTRIBUTE),
     }
 }
 
@@ -47,12 +47,74 @@ fn get_trusted_value_fn(security_context: SecurityContext) -> Option<&'static st
     }
 }
 
+/// The element-or-container create ops upstream indexes with
+/// `createOpXrefMap`, reduced to what the iframe fallback reads: whether the
+/// owner op is an `elementStart` whose tag is `iframe`.
+///
+/// Upstream's `isIframeElement` checks `op.kind === OpKind.ElementStart`, so
+/// self-closing `element()` ops are intentionally not matched.
+fn create_op_xref_map<'a>(ops: impl Iterator<Item = &'a CreateOp<'a>>) -> FxHashMap<XrefId, bool> {
+    let mut elements = FxHashMap::default();
+    for op in ops {
+        let (xref, is_iframe) = match op {
+            CreateOp::ElementStart(op) => (op.xref, op.tag.as_str().eq_ignore_ascii_case("iframe")),
+            CreateOp::Element(op) => (op.xref, false),
+            CreateOp::ContainerStart(op) => (op.xref, false),
+            CreateOp::Container(op) => (op.xref, false),
+            CreateOp::Template(op) => (op.xref, false),
+            CreateOp::Conditional(op) => (op.xref, false),
+            CreateOp::ConditionalBranch(op) => (op.xref, false),
+            CreateOp::RepeaterCreate(op) => {
+                // Upstream indexes the `@empty` view under the same repeater op.
+                if let Some(empty_view) = op.empty_view {
+                    elements.insert(empty_view, false);
+                }
+                (op.xref, false)
+            }
+            _ => continue,
+        };
+        elements.insert(xref, is_iframe);
+    }
+    elements
+}
+
+/// Apply upstream's legacy `ɵɵvalidateIframeAttribute` fallback: when a
+/// `Property` / `Attribute` / `DomProperty` op got no sanitizer from its
+/// security context, a security-sensitive iframe attribute gets the runtime
+/// validator. Removed upstream once the schema's `attributeNoBinding` iframe
+/// keys covered the same attributes (19.2.17 / 20.3.15 / 21.0.2).
+fn resolve_iframe_sanitizer(
+    assume_iframe: bool,
+    elements: &FxHashMap<XrefId, bool>,
+    target: XrefId,
+    name: &str,
+    sanitizer: &mut Option<Ident<'_>>,
+) {
+    if sanitizer.is_some() {
+        return;
+    }
+    // For host bindings and `DomProperty` ops the element is not known at
+    // compile time, so upstream assumes it may be an iframe; the emitted
+    // validator checks the real tag at runtime.
+    let is_iframe = if assume_iframe {
+        true
+    } else {
+        *elements
+            .get(&target)
+            .unwrap_or_else(|| panic!("Property should have an element-like owner"))
+    };
+    if is_iframe && is_iframe_security_sensitive_attr(name) {
+        *sanitizer = Some(Ident::from(Identifiers::VALIDATE_IFRAME_ATTRIBUTE));
+    }
+}
+
 /// Resolves security sanitizers for property bindings.
 ///
 /// This phase:
 /// 1. For ExtractedAttribute ops (constant attributes), sets the trusted value function
 /// 2. For Property, Attribute, and DomProperty ops, sets the sanitizer function
 pub fn resolve_sanitizers(job: &mut ComponentCompilationJob<'_>) {
+    let iframe_validation = uses_iframe_attr_validation(job.angular_version);
     // Collect view xrefs to avoid borrow issues
     let view_xrefs: Vec<_> = job.all_views().map(|v| v.xref).collect();
 
@@ -67,6 +129,8 @@ pub fn resolve_sanitizers(job: &mut ComponentCompilationJob<'_>) {
                 }
             }
 
+            let elements = iframe_validation.then(|| create_op_xref_map(view.create.iter()));
+
             // Process update ops - set sanitizers for property/attribute bindings
             for op in view.update.iter_mut() {
                 match op {
@@ -74,16 +138,43 @@ pub fn resolve_sanitizers(job: &mut ComponentCompilationJob<'_>) {
                         if let Some(fn_name) = get_sanitizer_fn(prop.security_context) {
                             prop.sanitizer = Some(Ident::from(fn_name));
                         }
+                        if let Some(elements) = &elements {
+                            resolve_iframe_sanitizer(
+                                false,
+                                elements,
+                                prop.target,
+                                prop.name.as_str(),
+                                &mut prop.sanitizer,
+                            );
+                        }
                     }
                     UpdateOp::Attribute(attr) => {
                         if let Some(fn_name) = get_sanitizer_fn(attr.security_context) {
                             attr.sanitizer = Some(Ident::from(fn_name));
                         }
+                        if let Some(elements) = &elements {
+                            resolve_iframe_sanitizer(
+                                false,
+                                elements,
+                                attr.target,
+                                attr.name.as_str(),
+                                &mut attr.sanitizer,
+                            );
+                        }
                     }
                     UpdateOp::DomProperty(dom_prop) => {
                         if let Some(fn_name) = get_sanitizer_fn(dom_prop.security_context) {
                             dom_prop.sanitizer = Some(Ident::from(fn_name));
                         }
+                        if let Some(elements) = &elements {
+                            resolve_iframe_sanitizer(
+                                true,
+                                elements,
+                                dom_prop.target,
+                                dom_prop.name.as_str(),
+                                &mut dom_prop.sanitizer,
+                            );
+                        }
                     }
                     _ => {}
                 }
@@ -96,6 +187,8 @@ pub fn resolve_sanitizers(job: &mut ComponentCompilationJob<'_>) {
 ///
 /// Host version - only processes the root unit (no embedded views).
 pub fn resolve_sanitizers_for_host(job: &mut HostBindingCompilationJob<'_>) {
+    let iframe_validation = uses_iframe_attr_validation(job.angular_version);
+
     // Process create ops - set trusted value functions for extracted attributes
     for op in job.root.create.iter_mut() {
         if let CreateOp::ExtractedAttribute(attr) = op {
@@ -107,23 +200,31 @@ pub fn resolve_sanitizers_for_host(job: &mut HostBindingCompilationJob<'_>) {
 
     // Process update ops - set sanitizers for property/attribute bindings
     for op in job.root.update.iter_mut() {
-        match op {
+        let (name, sanitizer) = match op {
             UpdateOp::Property(prop) => {
                 if let Some(fn_name) = get_sanitizer_fn(prop.security_context) {
                     prop.sanitizer = Some(Ident::from(fn_name));
                 }
+                (prop.name.as_str(), &mut prop.sanitizer)
             }
             UpdateOp::Attribute(attr) => {
                 if let Some(fn_name) = get_sanitizer_fn(attr.security_context) {
                     attr.sanitizer = Some(Ident::from(fn_name));
                 }
+                (attr.name.as_str(), &mut attr.sanitizer)
             }
             UpdateOp::DomProperty(dom_prop) => {
                 if let Some(fn_name) = get_sanitizer_fn(dom_prop.security_context) {
                     dom_prop.sanitizer = Some(Ident::from(fn_name));
                 }
+                (dom_prop.name.as_str(), &mut dom_prop.sanitizer)
             }
-            _ => {}
+            _ => continue,
+        };
+        // A host job cannot know its host element at compile time, so upstream
+        // assumes iframe and defers the tag check to the runtime validator.
+        if iframe_validation && sanitizer.is_none() && is_iframe_security_sensitive_attr(name) {
+            *sanitizer = Some(Ident::from(Identifiers::VALIDATE_IFRAME_ATTRIBUTE));
         }
     }
 }
diff --git a/crates/oxc_angular_compiler/src/pipeline/selector.rs b/crates/oxc_angular_compiler/src/pipeline/selector.rs
index c00ea2349..a58031825 100644
--- a/crates/oxc_angular_compiler/src/pipeline/selector.rs
+++ b/crates/oxc_angular_compiler/src/pipeline/selector.rs
@@ -245,9 +245,10 @@ impl CssSelector {
                 continue;
             }
 
-            // Handle * wildcard element
+            // `*` is a wildcard, not an element name: upstream's regexp has no
+            // `*` production, so `element` stays unset and selector consumers
+            // treat it as "any element".
             if c == '*' {
-                target.set_element("*");
                 i += 1;
                 continue;
             }
diff --git a/crates/oxc_angular_compiler/src/r3/identifiers.rs b/crates/oxc_angular_compiler/src/r3/identifiers.rs
index 3787ffe5a..38ae09ea7 100644
--- a/crates/oxc_angular_compiler/src/r3/identifiers.rs
+++ b/crates/oxc_angular_compiler/src/r3/identifiers.rs
@@ -912,6 +912,9 @@ impl Identifiers {
     /// Validate attribute.
     pub const VALIDATE_ATTRIBUTE: &'static str = "ɵɵvalidateAttribute";
 
+    /// Validate iframe attribute.
+    pub const VALIDATE_IFRAME_ATTRIBUTE: &'static str = "ɵɵvalidateIframeAttribute";
+
     /// Sanitize resource URL.
     pub const SANITIZE_RESOURCE_URL: &'static str = "ɵɵsanitizeResourceUrl";
 
diff --git a/crates/oxc_angular_compiler/src/schema/dom_security_schema.rs b/crates/oxc_angular_compiler/src/schema/dom_security_schema.rs
index 30c5337e9..f7c1f7155 100644
--- a/crates/oxc_angular_compiler/src/schema/dom_security_schema.rs
+++ b/crates/oxc_angular_compiler/src/schema/dom_security_schema.rs
@@ -1,272 +1,1064 @@
 //! DOM Security Schema
 //!
-//! This module contains the security schema that maps element|property combinations
-//! to their appropriate security context for sanitization.
-//!
-//! Ported from Angular's `schema/dom_security_schema.ts`.
+//! Maps `element|property` pairs to the sanitizer Angular applies.
+//! Ported from `@angular/compiler` v22 `schema/dom_security_schema.ts`.
 //!
 //! DO NOT EDIT THIS LIST OF SECURITY SENSITIVE PROPERTIES WITHOUT A SECURITY REVIEW!
 
-use crate::ast::r3::SecurityContext;
-use rustc_hash::FxHashMap;
 use std::sync::LazyLock;
 
-/// Security schema mapping `"element|property"` to `SecurityContext`.
-/// Properties applying to all elements use `"*"` as the element name.
-static SECURITY_SCHEMA: LazyLock<FxHashMap<&'static str, SecurityContext>> = LazyLock::new(|| {
+use rustc_hash::{FxHashMap, FxHashSet};
+
+use crate::ast::r3::SecurityContext;
+use crate::parser::html::split_ns_name;
+use crate::pipeline::selector::CssSelector;
+
+/// Which Angular security schema a compilation is targeting.
+///
+/// `None` means the latest schema (v22). Security fixes were backported per
+/// release line, so the cutovers are not monotonic: e.g. `attributeName`
+/// no-binding reached 20.3.15 and 21.0.2 but `script|href` only reached
+/// 20.3.16 and 21.0.7, and the namespaced schema landed on 20.3.22 and
+/// 21.2.14 while 21.0.x / 21.1.x never received it.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+enum SchemaKind {
+    /// 21.0.0 / 21.0.1 and everything below 20.3.15. Old URL set with
+    /// `*|ping`, `*|cite`, `applet|code`, `media|src`, etc.
+    Legacy,
+    /// 19.2.17, 20.3.15, 21.0.2–21.0.5. Adds MathML hrefs, `attributeName`
+    /// no-binding, and iframe sandbox keys on top of the old URL set.
+    V20_3_15,
+    /// 21.0.6 only. The hardening without the legacy URL keys, and before
+    /// `script|href` landed in 21.0.7.
+    V21_0_6,
+    /// 20.3.16–20.3.21 and 21.0.7 through 21.2.6. Adds `script|href`; the
+    /// `ping`/`cite`/`applet`/`media` keys are gone from 21.0.6 on.
+    V21_1,
+    /// Same as `V21_1` but still carrying the legacy URL keys: 19.2.18–19.2.22
+    /// and 20.3.16–20.3.21 (the key removal was never backported to either
+    /// maintained line).
+    V20_3_16,
+    /// 21.2.7 through 21.2.13. Animation `to` / `from` / `values` are bare keys.
+    V21_2_7,
+    /// 21.2.14 only. Namespaced keys but no `:svg:a|href` yet.
+    V21_2_14,
+    /// 19.2.23+, 20.3.22+, 21.2.15+, 22+. Namespaced keys with `:svg:a|href`.
+    /// `script|src` and `script|href` are gone.
+    V22,
+}
+
+struct SecurityProfile {
+    kind: SchemaKind,
+    /// The schema keys keep `:svg:` / `:math:` prefixes (21.2.14+, 19.2.23+,
+    /// 20.3.22+). `calcPossibleSecurityContexts` rewrites selectors for these
+    /// versions.
+    namespaced: bool,
+    /// `securityContext` runs `normalizeTagName`, stripping non-svg/math
+    /// prefixes from the element before the lookup. Upstream added the
+    /// normalizer one release after the namespaced schema: 21.2.14 looks the
+    /// verbatim tag up, so `:xml:iframe|src` misses there but hits `iframe|src`
+    /// at 21.2.15+.
+    normalizes_tag_names: bool,
+    /// The preparser strips `:svg:script` as well as `script`.
+    strip_svg_script: bool,
+    /// The preparser also strips `:svg:style`. Only 19.2.23, 20.3.22 and
+    /// 21.2.14 did this; it was reverted everywhere else.
+    strip_svg_style: bool,
+    /// `iframe|src` joined Trusted Types sinks (19.2.20+, 20.3.18–21, 21.2.4+;
+    /// never on the 21.0.x / 21.1.x lines).
+    iframe_src_i18n: bool,
+    /// `resolve_sanitizers` falls back to `ɵɵvalidateIframeAttribute` for
+    /// security-sensitive iframe attributes with no other sanitizer. Upstream
+    /// removed this when the iframe `attributeNoBinding` keys landed
+    /// (19.2.17 / 20.3.15 / 21.0.2), so it only exists on the legacy schema.
+    iframe_attr_validation: bool,
+}
+
+fn security_profile(version: Option<crate::AngularVersion>) -> SecurityProfile {
+    let Some(version) = version else {
+        return v22_profile();
+    };
+    if version.major >= 22 {
+        return v22_profile();
+    }
+
+    let (kind, iframe_src_i18n) = match version.major {
+        19 if version.minor >= 2 => match version.patch {
+            0..=16 => (SchemaKind::Legacy, false),
+            17 => (SchemaKind::V20_3_15, false),
+            18..=19 => (SchemaKind::V20_3_16, false),
+            20..=22 => (SchemaKind::V20_3_16, true),
+            // 19.2.23+ has the namespaced schema with `:svg:a|href`.
+            _ => (SchemaKind::V22, true),
+        },
+        20 if version.minor >= 3 => match version.patch {
+            0..=14 => (SchemaKind::Legacy, false),
+            15 => (SchemaKind::V20_3_15, false),
+            16..=17 => (SchemaKind::V20_3_16, false),
+            18..=21 => (SchemaKind::V20_3_16, true),
+            // 20.3.22+ has the namespaced schema with `:svg:a|href`.
+            _ => (SchemaKind::V22, true),
+        },
+        21 => match (version.minor, version.patch) {
+            (0, 0..=1) => (SchemaKind::Legacy, false),
+            (0, 2..=5) => (SchemaKind::V20_3_15, false),
+            (0, 6) => (SchemaKind::V21_0_6, false),
+            (0, _) => (SchemaKind::V21_1, false),
+            (1, _) => (SchemaKind::V21_1, false),
+            (2, 0..=3) => (SchemaKind::V21_1, false),
+            (2, 4..=6) => (SchemaKind::V21_1, true),
+            (2, 7..=13) => (SchemaKind::V21_2_7, true),
+            (2, 14) => (SchemaKind::V21_2_14, true),
+            // 21.2.15+ and any later 21.x minor use the namespaced schema.
+            _ => (SchemaKind::V22, true),
+        },
+        _ => (SchemaKind::Legacy, false),
+    };
+
+    let namespaced = matches!(kind, SchemaKind::V21_2_14 | SchemaKind::V22);
+    // `:svg:style` stripping existed only in 19.2.23, 20.3.22 and 21.2.14.
+    let strip_svg_style = matches!(kind, SchemaKind::V21_2_14)
+        || (version.major == 20 && version.minor == 3 && version.patch == 22)
+        || (version.major == 19 && version.minor == 2 && version.patch == 23);
+    SecurityProfile {
+        kind,
+        namespaced,
+        // `normalizeTagName` in `securityContext` landed with the schema
+        // backports that carried `:svg:a|href` (19.2.23 / 20.3.22 / 21.2.15);
+        // 21.2.14 has namespaced keys but no normalizer.
+        normalizes_tag_names: matches!(kind, SchemaKind::V22),
+        strip_svg_script: namespaced,
+        strip_svg_style,
+        iframe_src_i18n,
+        iframe_attr_validation: matches!(kind, SchemaKind::Legacy),
+    }
+}
+
+fn v22_profile() -> SecurityProfile {
+    SecurityProfile {
+        kind: SchemaKind::V22,
+        namespaced: true,
+        normalizes_tag_names: true,
+        strip_svg_script: true,
+        strip_svg_style: false,
+        iframe_src_i18n: true,
+        iframe_attr_validation: false,
+    }
+}
+
+/// Whether this Angular version strips `:svg:script` during template lowering.
+pub fn strips_namespaced_svg_script(version: Option<crate::AngularVersion>) -> bool {
+    security_profile(version).strip_svg_script
+}
+
+/// Whether this Angular version's preparser classifies `:svg:style` as a style
+/// element (its text is collected into component styles and the element is
+/// dropped). Only 20.3.22 and 21.2.14 did this.
+pub fn strips_namespaced_svg_style(version: Option<crate::AngularVersion>) -> bool {
+    security_profile(version).strip_svg_style
+}
+
+/// Whether this Angular version's schema keys keep `:svg:` / `:math:` prefixes.
+/// `calcPossibleSecurityContexts` only promotes bare selector elements to
+/// their `:svg:` / `:math:` forms on the namespaced schema.
+pub fn uses_namespaced_schema(version: Option<crate::AngularVersion>) -> bool {
+    security_profile(version).namespaced
+}
+
+/// Whether i18n must reject `iframe` `src` as a Trusted Types sink.
+pub fn rejects_iframe_src_i18n(version: Option<crate::AngularVersion>) -> bool {
+    security_profile(version).iframe_src_i18n
+}
+
+/// Whether `resolve_sanitizers` applies the `ɵɵvalidateIframeAttribute`
+/// fallback. Upstream kept it on versions without the iframe
+/// `attributeNoBinding` schema keys (everything before 19.2.17 / 20.3.15 /
+/// 21.0.2) and dropped it once those keys covered the same attributes.
+pub fn uses_iframe_attr_validation(version: Option<crate::AngularVersion>) -> bool {
+    security_profile(version).iframe_attr_validation
+}
+
+/// Whether `attr_name` is a security-sensitive `<iframe>` attribute
+/// (`IFRAME_SECURITY_SENSITIVE_ATTRS`). The comparison is case-insensitive
+/// because `setAttribute` lowercases names.
+pub fn is_iframe_security_sensitive_attr(attr_name: &str) -> bool {
+    matches!(
+        attr_name.to_ascii_lowercase().as_str(),
+        "sandbox" | "allow" | "allowfullscreen" | "referrerpolicy" | "csp" | "fetchpriority"
+    )
+}
+
+fn build_v22_schema(with_svg_a: bool) -> FxHashMap<String, SecurityContext> {
     let mut schema = FxHashMap::default();
 
-    // HTML contexts - content that will be parsed as HTML
-    register_context(
+    register(
         &mut schema,
         SecurityContext::Html,
-        &["iframe|srcdoc", "*|innerhtml", "*|outerhtml"],
+        None,
+        &[("iframe", &["srcdoc"]), ("*", &["innerHTML", "outerHTML"])],
     );
+    register(&mut schema, SecurityContext::Style, None, &[("*", &["style"])]);
 
-    // Style contexts - CSS style content
-    register_context(&mut schema, SecurityContext::Style, &["*|style"]);
-
-    // URL contexts - URLs that are navigable (less dangerous than resource URLs)
-    register_context(
+    // No SCRIPT contexts: the parser strips `<script>` and `:svg:script`.
+    register(
         &mut schema,
         SecurityContext::Url,
+        None,
         &[
-            "*|formaction",
-            "area|href",
-            "a|href",
-            "a|xlink:href",
-            "form|action",
-            // MathML namespace URLs
-            "annotation|href",
-            "annotation|xlink:href",
-            "annotation-xml|href",
-            "annotation-xml|xlink:href",
-            "maction|href",
-            "maction|xlink:href",
-            "malignmark|href",
-            "malignmark|xlink:href",
-            "math|href",
-            "math|xlink:href",
-            "mroot|href",
-            "mroot|xlink:href",
-            "msqrt|href",
-            "msqrt|xlink:href",
-            "merror|href",
-            "merror|xlink:href",
-            "mfrac|href",
-            "mfrac|xlink:href",
-            "mglyph|href",
-            "mglyph|xlink:href",
-            "msub|href",
-            "msub|xlink:href",
-            "msup|href",
-            "msup|xlink:href",
-            "msubsup|href",
-            "msubsup|xlink:href",
-            "mmultiscripts|href",
-            "mmultiscripts|xlink:href",
-            "mprescripts|href",
-            "mprescripts|xlink:href",
-            "mi|href",
-            "mi|xlink:href",
-            "mn|href",
-            "mn|xlink:href",
-            "mo|href",
-            "mo|xlink:href",
-            "mpadded|href",
-            "mpadded|xlink:href",
-            "mphantom|href",
-            "mphantom|xlink:href",
-            "mrow|href",
-            "mrow|xlink:href",
-            "ms|href",
-            "ms|xlink:href",
-            "mspace|href",
-            "mspace|xlink:href",
-            "mstyle|href",
-            "mstyle|xlink:href",
-            "mtable|href",
-            "mtable|xlink:href",
-            "mtd|href",
-            "mtd|xlink:href",
-            "mtr|href",
-            "mtr|xlink:href",
-            "mtext|href",
-            "mtext|xlink:href",
-            "mover|href",
-            "mover|xlink:href",
-            "munder|href",
-            "munder|xlink:href",
-            "munderover|href",
-            "munderover|xlink:href",
-            "semantics|href",
-            "semantics|xlink:href",
-            "none|href",
-            "none|xlink:href",
-            // These are safe but included for compatibility
-            "img|src",
-            "video|src",
+            ("*", &["formAction"]),
+            ("area", &["href"]),
+            ("a", &["href", "xlink:href"]),
+            ("form", &["action"]),
+            // Kept for compatibility with upstream; safe in practice.
+            ("img", &["src"]),
+            ("video", &["src"]),
         ],
     );
 
-    // Resource URL contexts - URLs that load executable content
-    register_context(
+    register_uniform(
+        &mut schema,
+        SecurityContext::Url,
+        Some("math"),
+        MATHML_URL_ELEMENTS,
+        &["href", "xlink:href"],
+    );
+
+    register(
         &mut schema,
         SecurityContext::ResourceUrl,
+        None,
         &[
-            "base|href",
-            "embed|src",
-            "frame|src",
-            "iframe|src",
-            "link|href",
-            "object|codebase",
-            "object|data",
-            "script|src",
+            ("base", &["href"]),
+            ("embed", &["src"]),
+            ("frame", &["src"]),
+            ("iframe", &["src"]),
+            ("link", &["href"]),
+            ("object", &["codebase", "data"]),
         ],
     );
 
-    // Attribute no-binding contexts - attributes that should not be bound
-    // These are unsafe as `attributeName` can be `href` or `xlink:href`
-    register_context(
+    // `:svg:a|href` landed in 20.3.22 / 21.2.15; 21.2.14 did not have it.
+    if with_svg_a {
+        register(&mut schema, SecurityContext::Url, Some("svg"), &[("a", &["href", "xlink:href"])]);
+    }
+
+    // SVG animation value attributes can retarget `href` / `xlink:href`.
+    // Upstream registers them under the SVG namespace as ATTRIBUTE_NO_BINDING.
+    register(
         &mut schema,
         SecurityContext::AttributeNoBinding,
+        Some("svg"),
         &[
-            "animate|attributename",
-            "set|attributename",
-            "animatemotion|attributename",
-            "animatetransform|attributename",
-            "unknown|attributename",
-            "iframe|sandbox",
-            "iframe|allow",
-            "iframe|allowfullscreen",
-            "iframe|referrerpolicy",
-            "iframe|csp",
-            "iframe|fetchpriority",
-            "unknown|sandbox",
-            "unknown|allow",
-            "unknown|allowfullscreen",
-            "unknown|referrerpolicy",
-            "unknown|csp",
-            "unknown|fetchpriority",
+            ("animate", &["attributeName", "values", "to", "from"]),
+            ("set", &["to", "attributeName"]),
+            ("animateMotion", &["attributeName"]),
+            ("animateTransform", &["attributeName"]),
         ],
     );
 
+    register(
+        &mut schema,
+        SecurityContext::AttributeNoBinding,
+        None,
+        &[
+            (
+                "unknown",
+                &[
+                    "attributeName",
+                    "values",
+                    "to",
+                    "from",
+                    "sandbox",
+                    "allow",
+                    "allowFullscreen",
+                    "referrerPolicy",
+                    "csp",
+                    "fetchPriority",
+                ],
+            ),
+            (
+                "iframe",
+                &["sandbox", "allow", "allowFullscreen", "referrerPolicy", "csp", "fetchPriority"],
+            ),
+        ],
+    );
+
+    schema
+}
+
+static V22_SCHEMA: LazyLock<FxHashMap<String, SecurityContext>> =
+    LazyLock::new(|| build_v22_schema(true));
+static V21_2_14_SCHEMA: LazyLock<FxHashMap<String, SecurityContext>> =
+    LazyLock::new(|| build_v22_schema(false));
+static V21_27_SCHEMA: LazyLock<FxHashMap<String, SecurityContext>> =
+    LazyLock::new(|| build_pren22_schema(SchemaKind::V21_2_7));
+static V21_1_SCHEMA: LazyLock<FxHashMap<String, SecurityContext>> =
+    LazyLock::new(|| build_pren22_schema(SchemaKind::V21_1));
+static V20_3_16_SCHEMA: LazyLock<FxHashMap<String, SecurityContext>> =
+    LazyLock::new(|| build_pren22_schema(SchemaKind::V20_3_16));
+static V20_3_15_SCHEMA: LazyLock<FxHashMap<String, SecurityContext>> =
+    LazyLock::new(|| build_pren22_schema(SchemaKind::V20_3_15));
+static V21_0_6_SCHEMA: LazyLock<FxHashMap<String, SecurityContext>> =
+    LazyLock::new(|| build_pren22_schema(SchemaKind::V21_0_6));
+static LEGACY_SCHEMA: LazyLock<FxHashMap<String, SecurityContext>> =
+    LazyLock::new(|| build_pren22_schema(SchemaKind::Legacy));
+
+fn schema_for(kind: SchemaKind) -> &'static FxHashMap<String, SecurityContext> {
+    match kind {
+        SchemaKind::Legacy => &LEGACY_SCHEMA,
+        SchemaKind::V20_3_15 => &V20_3_15_SCHEMA,
+        SchemaKind::V21_0_6 => &V21_0_6_SCHEMA,
+        SchemaKind::V20_3_16 => &V20_3_16_SCHEMA,
+        SchemaKind::V21_1 => &V21_1_SCHEMA,
+        SchemaKind::V21_2_7 => &V21_27_SCHEMA,
+        SchemaKind::V21_2_14 => &V21_2_14_SCHEMA,
+        SchemaKind::V22 => &V22_SCHEMA,
+    }
+}
+/// Pre-v22 schemas look up bare `tag|attr` keys (`normalizeTagName` did not keep
+/// namespaces yet), so nothing here registers `:svg:` or `:math:` keys.
+fn build_pren22_schema(kind: SchemaKind) -> FxHashMap<String, SecurityContext> {
+    let mut schema = FxHashMap::default();
+    register_base_html_style_and_url(&mut schema);
+
+    let hardened = kind != SchemaKind::Legacy;
+    let legacy_url_keys =
+        matches!(kind, SchemaKind::Legacy | SchemaKind::V20_3_15 | SchemaKind::V20_3_16);
+    // `script|href` / `script|xlink:href` landed in 20.3.16 and 21.0.7.
+    let script_href =
+        matches!(kind, SchemaKind::V20_3_16 | SchemaKind::V21_1 | SchemaKind::V21_2_7);
+
+    if hardened {
+        // `a|xlink:href` was added with the MathML hardening; the Legacy URL
+        // set has only `a|href` / `a|ping`.
+        register(&mut schema, SecurityContext::Url, None, &[("a", &["xlink:href"])]);
+        register_uniform(
+            &mut schema,
+            SecurityContext::Url,
+            None,
+            MATHML_URL_ELEMENTS,
+            &["href", "xlink:href"],
+        );
+    }
+
+    if legacy_url_keys {
+        register(
+            &mut schema,
+            SecurityContext::Url,
+            None,
+            &[
+                ("area", &["ping"]),
+                ("audio", &["src"]),
+                ("a", &["ping"]),
+                ("blockquote", &["cite"]),
+                ("body", &["background"]),
+                ("del", &["cite"]),
+                ("input", &["src"]),
+                ("ins", &["cite"]),
+                ("q", &["cite"]),
+                ("source", &["src"]),
+                ("track", &["src"]),
+                ("video", &["poster"]),
+            ],
+        );
+        register(
+            &mut schema,
+            SecurityContext::ResourceUrl,
+            None,
+            &[
+                ("applet", &["code", "codebase"]),
+                ("head", &["profile"]),
+                ("html", &["manifest"]),
+                ("media", &["src"]),
+            ],
+        );
+    }
+
+    register(
+        &mut schema,
+        SecurityContext::ResourceUrl,
+        None,
+        &[
+            ("base", &["href"]),
+            ("embed", &["src"]),
+            ("frame", &["src"]),
+            ("iframe", &["src"]),
+            ("link", &["href"]),
+            ("object", &["codebase", "data"]),
+            ("script", &["src"]),
+        ],
+    );
+    if script_href {
+        register(
+            &mut schema,
+            SecurityContext::ResourceUrl,
+            None,
+            &[("script", &["href", "xlink:href"])],
+        );
+    }
+
+    if hardened {
+        register(
+            &mut schema,
+            SecurityContext::AttributeNoBinding,
+            None,
+            &[
+                ("animate", &["attributeName"]),
+                ("set", &["attributeName"]),
+                ("animateMotion", &["attributeName"]),
+                ("animateTransform", &["attributeName"]),
+                ("unknown", &["attributeName"]),
+                (
+                    "iframe",
+                    &[
+                        "sandbox",
+                        "allow",
+                        "allowFullscreen",
+                        "referrerPolicy",
+                        "csp",
+                        "fetchPriority",
+                    ],
+                ),
+                (
+                    "unknown",
+                    &[
+                        "sandbox",
+                        "allow",
+                        "allowFullscreen",
+                        "referrerPolicy",
+                        "csp",
+                        "fetchPriority",
+                    ],
+                ),
+            ],
+        );
+    }
+    if matches!(kind, SchemaKind::V21_2_7) {
+        register(
+            &mut schema,
+            SecurityContext::AttributeNoBinding,
+            None,
+            &[
+                ("animate", &["values", "to", "from"]),
+                ("set", &["to"]),
+                ("unknown", &["values", "to", "from"]),
+            ],
+        );
+    }
     schema
-});
+}
+
+fn register_base_html_style_and_url(schema: &mut FxHashMap<String, SecurityContext>) {
+    register(
+        schema,
+        SecurityContext::Html,
+        None,
+        &[("iframe", &["srcdoc"]), ("*", &["innerHTML", "outerHTML"])],
+    );
+    register(schema, SecurityContext::Style, None, &[("*", &["style"])]);
+    register(
+        schema,
+        SecurityContext::Url,
+        None,
+        &[
+            ("*", &["formAction"]),
+            ("area", &["href"]),
+            // `a|xlink:href` is not in the Legacy URL set; callers add it for
+            // hardened kinds.
+            ("a", &["href"]),
+            ("form", &["action"]),
+            ("img", &["src"]),
+            ("video", &["src"]),
+        ],
+    );
+}
+
+/// MathML elements whose `href` / `xlink:href` are URL sinks in the security schema.
+/// `annotation`, `malignmark`, `mglyph`, `mprescripts`, and `none` are not in the
+/// DOM element schema, so the host-element scan never reaches them. Template lookup
+/// still hits the `:math:` key when the parser names the element that way.
+const MATHML_URL_ELEMENTS: &[&str] = &[
+    "annotation",
+    "annotation-xml",
+    "maction",
+    "malignmark",
+    "math",
+    "mroot",
+    "msqrt",
+    "merror",
+    "mfrac",
+    "mglyph",
+    "msub",
+    "msup",
+    "msubsup",
+    "mmultiscripts",
+    "mprescripts",
+    "mi",
+    "mn",
+    "mo",
+    "mpadded",
+    "mphantom",
+    "mrow",
+    "ms",
+    "mspace",
+    "mstyle",
+    "mtable",
+    "mtd",
+    "mtr",
+    "mtext",
+    "mover",
+    "munder",
+    "munderover",
+    "semantics",
+    "none",
+];
 
-/// Registers a list of element|property specs with the given security context.
-fn register_context(
-    schema: &mut FxHashMap<&'static str, SecurityContext>,
+/// Lowercased tag names from `DomElementSchemaRegistry`'s `SCHEMA` array.
+/// This is `allKnownElementNames()` for the host-binding scan.
+const KNOWN_ELEMENT_NAMES: &[&str] = &[
+    "[element]",
+    "[htmlelement]",
+    "abbr",
+    "address",
+    "article",
+    "aside",
+    "b",
+    "bdi",
+    "bdo",
+    "cite",
+    "content",
+    "code",
+    "dd",
+    "dfn",
+    "dt",
+    "em",
+    "figcaption",
+    "figure",
+    "footer",
+    "header",
+    "hgroup",
+    "i",
+    "kbd",
+    "main",
+    "mark",
+    "nav",
+    "noscript",
+    "rb",
+    "rp",
+    "rt",
+    "rtc",
+    "ruby",
+    "s",
+    "samp",
+    "search",
+    "section",
+    "small",
+    "strong",
+    "sub",
+    "sup",
+    "u",
+    "var",
+    "wbr",
+    "media",
+    ":svg:",
+    ":svg:graphics",
+    ":svg:animation",
+    ":svg:geometry",
+    ":svg:componenttransferfunction",
+    ":svg:gradient",
+    ":svg:textcontent",
+    ":svg:textpositioning",
+    "a",
+    "area",
+    "audio",
+    "br",
+    "base",
+    "body",
+    "button",
+    "canvas",
+    "dl",
+    "data",
+    "datalist",
+    "details",
+    "dialog",
+    "dir",
+    "div",
+    "embed",
+    "fieldset",
+    "font",
+    "form",
+    "frame",
+    "frameset",
+    "geolocation",
+    "hr",
+    "head",
+    "h1",
+    "h2",
+    "h3",
+    "h4",
+    "h5",
+    "h6",
+    "html",
+    "iframe",
+    "img",
+    "input",
+    "li",
+    "label",
+    "legend",
+    "link",
+    "map",
+    "marquee",
+    "menu",
+    "meta",
+    "meter",
+    "ins",
+    "del",
+    "ol",
+    "object",
+    "optgroup",
+    "option",
+    "output",
+    "p",
+    "param",
+    "picture",
+    "pre",
+    "progress",
+    "q",
+    "blockquote",
+    "script",
+    "select",
+    "selectedcontent",
+    "slot",
+    "source",
+    "span",
+    "style",
+    "caption",
+    "th",
+    "td",
+    "col",
+    "colgroup",
+    "table",
+    "tr",
+    "tfoot",
+    "thead",
+    "tbody",
+    "template",
+    "textarea",
+    "time",
+    "title",
+    "track",
+    "ul",
+    "unknown",
+    "video",
+    ":svg:a",
+    ":svg:animate",
+    ":svg:animatemotion",
+    ":svg:animatetransform",
+    ":svg:circle",
+    ":svg:clippath",
+    ":svg:defs",
+    ":svg:desc",
+    ":svg:discard",
+    ":svg:ellipse",
+    ":svg:feblend",
+    ":svg:fecolormatrix",
+    ":svg:fecomponenttransfer",
+    ":svg:fecomposite",
+    ":svg:feconvolvematrix",
+    ":svg:fediffuselighting",
+    ":svg:fedisplacementmap",
+    ":svg:fedistantlight",
+    ":svg:fedropshadow",
+    ":svg:feflood",
+    ":svg:fefunca",
+    ":svg:fefuncb",
+    ":svg:fefuncg",
+    ":svg:fefuncr",
+    ":svg:fegaussianblur",
+    ":svg:feimage",
+    ":svg:femerge",
+    ":svg:femergenode",
+    ":svg:femorphology",
+    ":svg:feoffset",
+    ":svg:fepointlight",
+    ":svg:fespecularlighting",
+    ":svg:fespotlight",
+    ":svg:fetile",
+    ":svg:feturbulence",
+    ":svg:filter",
+    ":svg:foreignobject",
+    ":svg:g",
+    ":svg:image",
+    ":svg:line",
+    ":svg:lineargradient",
+    ":svg:mpath",
+    ":svg:marker",
+    ":svg:mask",
+    ":svg:metadata",
+    ":svg:path",
+    ":svg:pattern",
+    ":svg:polygon",
+    ":svg:polyline",
+    ":svg:radialgradient",
+    ":svg:rect",
+    ":svg:svg",
+    ":svg:script",
+    ":svg:set",
+    ":svg:stop",
+    ":svg:style",
+    ":svg:switch",
+    ":svg:symbol",
+    ":svg:tspan",
+    ":svg:text",
+    ":svg:textpath",
+    ":svg:title",
+    ":svg:use",
+    ":svg:view",
+    "keygen",
+    "menuitem",
+    "summary",
+    ":svg:cursor",
+    ":math:",
+    ":math:math",
+    ":math:maction",
+    ":math:menclose",
+    ":math:merror",
+    ":math:mfenced",
+    ":math:mfrac",
+    ":math:mi",
+    ":math:mmultiscripts",
+    ":math:mn",
+    ":math:mo",
+    ":math:mover",
+    ":math:mpadded",
+    ":math:mphantom",
+    ":math:mroot",
+    ":math:mrow",
+    ":math:ms",
+    ":math:mspace",
+    ":math:msqrt",
+    ":math:mstyle",
+    ":math:msub",
+    ":math:msubsup",
+    ":math:msup",
+    ":math:mtable",
+    ":math:mtd",
+    ":math:mtext",
+    ":math:mtr",
+    ":math:munder",
+    ":math:munderover",
+    ":math:semantics",
+];
+
+static KNOWN_ELEMENT_SET: LazyLock<FxHashSet<&'static str>> =
+    LazyLock::new(|| KNOWN_ELEMENT_NAMES.iter().copied().collect());
+
+fn register(
+    schema: &mut FxHashMap<String, SecurityContext>,
     ctx: SecurityContext,
-    specs: &[&'static str],
+    namespace: Option<&str>,
+    specs: &[(&str, &[&str])],
 ) {
-    for spec in specs {
-        schema.insert(spec, ctx);
+    for &(element, attrs) in specs {
+        register_uniform(schema, ctx, namespace, &[element], attrs);
     }
 }
 
-/// Gets the security context for a given element and property combination.
-///
-/// The lookup is case-insensitive. Returns `SecurityContext::None` if no
-/// security-sensitive context is found.
-///
-/// # Arguments
-/// * `element` - The element tag name (e.g., "iframe", "a", "script")
-/// * `property` - The property name (e.g., "src", "href", "innerHTML")
+fn register_uniform(
+    schema: &mut FxHashMap<String, SecurityContext>,
+    ctx: SecurityContext,
+    namespace: Option<&str>,
+    elements: &[&str],
+    attrs: &[&str],
+) {
+    for element in elements {
+        let tag = match namespace {
+            Some(ns) if *element != "*" && *element != "unknown" => {
+                format!(":{ns}:{element}").to_ascii_lowercase()
+            }
+            _ => (*element).to_ascii_lowercase(),
+        };
+        for attr in attrs {
+            schema.insert(format!("{tag}|{}", attr.to_ascii_lowercase()), ctx);
+        }
+    }
+}
+
+/// Whether `name` is in the DOM element schema (`allKnownElementNames`),
+/// including `:svg:`/`:math:`-prefixed entries.
+pub fn is_known_element(name: &str) -> bool {
+    KNOWN_ELEMENT_SET.contains(name.to_ascii_lowercase().as_str())
+}
+
+/// `normalizeTagName` from `dom_element_schema_registry.ts`.
+/// `:svg:` and `:math:` are kept; every other namespace is stripped.
+fn normalize_tag_name(tag_name: &str) -> String {
+    let lower = tag_name.to_ascii_lowercase();
+    let (ns, name) = split_ns_name(&lower);
+    match ns {
+        Some(ns @ ("svg" | "math")) => format!(":{ns}:{name}"),
+        _ => name.to_string(),
+    }
+}
+
+/// Security context for one element and property on the latest schema (v22).
 ///
-/// # Returns
-/// The appropriate `SecurityContext` for sanitization.
+/// Case-insensitive. Returns `SecurityContext::None` when the pair is not a sink.
 pub fn get_security_context(element: &str, property: &str) -> SecurityContext {
-    let element_lower = element.to_ascii_lowercase();
+    get_security_context_for(element, property, None)
+}
+
+/// Security context for the Angular version being compiled.
+///
+/// Callers pass the resolved (possibly `:ns:`-prefixed) element name. Versions
+/// with `normalizeTagName` (19.2.23+, 20.3.22+, 21.2.15+) strip non-svg/math
+/// prefixes; every earlier version lowercases the tag as written, so
+/// `:xml:iframe|src` misses the schema while `:svg:animate|to` hits its
+/// namespaced key at 21.2.14.
+pub fn get_security_context_for(
+    element: &str,
+    property: &str,
+    version: Option<crate::AngularVersion>,
+) -> SecurityContext {
+    let profile = security_profile(version);
+    let tag = if profile.normalizes_tag_names {
+        normalize_tag_name(element)
+    } else {
+        element.to_ascii_lowercase()
+    };
     let property_lower = property.to_ascii_lowercase();
+    let schema = schema_for(profile.kind);
 
-    // First try element-specific lookup
-    let key = format!("{}|{}", element_lower, property_lower);
-    if let Some(&ctx) = SECURITY_SCHEMA.get(key.as_str()) {
+    let key = format!("{tag}|{property_lower}");
+    if let Some(&ctx) = schema.get(&key) {
         return ctx;
     }
 
-    // Then try wildcard lookup (properties that apply to all elements)
-    let wildcard_key = format!("*|{}", property_lower);
-    if let Some(&ctx) = SECURITY_SCHEMA.get(wildcard_key.as_str()) {
+    let wildcard_key = format!("*|{property_lower}");
+    if let Some(&ctx) = schema.get(&wildcard_key) {
         return ctx;
     }
 
-    // No security context needed
     SecurityContext::None
 }
 
-/// Calculates all possible security contexts for a property when the element is unknown.
+/// Union of security contexts for `property` across every known element.
 ///
-/// This is used when the host element isn't known at compile time (e.g., for directives
-/// that can be applied to multiple element types). The function checks all known elements
-/// to find all possible security contexts for the given property.
-///
-/// # Special Cases
-/// - If the property could have both `Url` and `ResourceUrl` contexts on different
-///   elements, returns `UrlOrResourceUrl` (resolved at runtime based on element tag)
-/// - If all elements have the same context, returns that context
-/// - If no elements have a security context, returns `None`
-///
-/// # Arguments
-/// * `property` - The property name (e.g., "src", "href")
-///
-/// # Returns
-/// The appropriate `SecurityContext` for sanitization.
+/// `Url` together with `ResourceUrl` collapses to `UrlOrResourceUrl`.
 pub fn calc_security_context_for_unknown_element(property: &str) -> SecurityContext {
-    let property_lower = property.to_ascii_lowercase();
+    host_binding_security_context("", property)
+}
 
-    // Collect all security contexts for this property across all elements
-    let mut has_url = false;
-    let mut has_resource_url = false;
-    let mut has_other = false;
-    let mut other_context = SecurityContext::None;
-
-    for (key, &ctx) in SECURITY_SCHEMA.iter() {
-        // Check if this entry is for our property (format: "element|property")
-        if let Some(pipe_pos) = key.find('|') {
-            let prop = &key[pipe_pos + 1..];
-            if prop.eq_ignore_ascii_case(&property_lower) {
-                match ctx {
-                    SecurityContext::Url => has_url = true,
-                    SecurityContext::ResourceUrl => has_resource_url = true,
-                    SecurityContext::None => {}
-                    _ => {
-                        has_other = true;
-                        other_context = ctx;
-                    }
-                }
+/// Security context of a host binding on the latest schema (v22).
+///
+/// Mirrors `calcPossibleSecurityContexts` plus the host ingest filter that drops
+/// `NONE` and the `{URL, RESOURCE_URL}` pair in `resolve_sanitizers.ts`.
+pub fn host_binding_security_context(selector: &str, prop_name: &str) -> SecurityContext {
+    host_binding_security_context_for(selector, prop_name, None)
+}
+
+/// Host-binding security context for a specific Angular version.
+pub fn host_binding_security_context_for(
+    selector: &str,
+    prop_name: &str,
+    version: Option<crate::AngularVersion>,
+) -> SecurityContext {
+    let contexts = if security_profile(version).namespaced {
+        collect_namespaced_contexts(selector, prop_name, version)
+    } else {
+        collect_bare_contexts(selector, prop_name, version)
+    };
+    reduce_security_contexts(&contexts)
+}
+
+fn collect_namespaced_contexts(
+    selector: &str,
+    prop_name: &str,
+    version: Option<crate::AngularVersion>,
+) -> Vec<SecurityContext> {
+    let selector = selector.trim();
+    if selector.is_empty() {
+        return KNOWN_ELEMENT_NAMES
+            .iter()
+            .map(|el| get_security_context_for(el, prop_name, version))
+            .collect();
+    }
+
+    // `splitNsName` treats any leading `:x:` as a namespace, including the
+    // `:not(` of a pseudo-class. Only a plain identifier is a namespace, so a
+    // selector like `:not(img):not(video)` reaches `CssSelector::parse` whole
+    // instead of parsing `not(video)` as the element.
+    let (namespace_key, base_selector) = match split_ns_name(selector) {
+        (Some(ns), _) if !ns.is_empty() && ns.bytes().all(is_selector_ident_byte) => {
+            split_ns_name(selector)
+        }
+        _ => (None, selector),
+    };
+    let mut contexts = Vec::new();
+    for css in CssSelector::parse(base_selector) {
+        let excluded = not_element_names(&css);
+        // A literal `*` element (only produced for a `:not(...)`-only selector)
+        // is looked up as the `*|attr` key, matching upstream: upstream expands
+        // `element === null` over all known elements but keeps `*` verbatim.
+        let element_names: Vec<String> = if let Some(element) = &css.element {
+            if element == "*" { vec![element.clone()] } else { resolve_concrete_element(element) }
+        } else {
+            KNOWN_ELEMENT_NAMES.iter().map(|name| (*name).to_string()).collect()
+        };
+
+        for element_name in element_names {
+            if is_not_excluded(&element_name, &excluded) {
+                let full_name = qualify_with_selector_namespace(&element_name, namespace_key);
+                contexts.push(get_security_context_for(&full_name, prop_name, version));
             }
         }
     }
+    contexts
+}
 
-    // Also check wildcard entries
-    let wildcard_key = format!("*|{}", property_lower);
-    if let Some(&ctx) = SECURITY_SCHEMA.get(wildcard_key.as_str()) {
-        match ctx {
-            SecurityContext::Url => has_url = true,
-            SecurityContext::ResourceUrl => has_resource_url = true,
-            SecurityContext::None => {}
-            _ => {
-                has_other = true;
-                other_context = ctx;
+/// v21 `calcPossibleSecurityContexts`: no namespace rewrite, and `:not(element)`
+/// matches the element string exactly, including case.
+fn collect_bare_contexts(
+    selector: &str,
+    prop_name: &str,
+    version: Option<crate::AngularVersion>,
+) -> Vec<SecurityContext> {
+    let selector = selector.trim();
+    if selector.is_empty() {
+        return KNOWN_ELEMENT_NAMES
+            .iter()
+            .map(|el| get_security_context_for(el, prop_name, version))
+            .collect();
+    }
+
+    let mut contexts = Vec::new();
+    for css in CssSelector::parse(selector) {
+        let excluded: FxHashSet<String> = css
+            .not_selectors
+            .iter()
+            .filter(|sel| {
+                sel.element.is_some()
+                    && sel.class_names.is_empty()
+                    && sel.attrs.is_empty()
+                    && sel.not_selectors.is_empty()
+            })
+            .filter_map(|sel| sel.element.clone())
+            .collect();
+        let element_names: Vec<String> = if let Some(element) = &css.element {
+            vec![element.clone()]
+        } else {
+            KNOWN_ELEMENT_NAMES.iter().map(|name| (*name).to_string()).collect()
+        };
+        for element_name in element_names {
+            if excluded.contains(&element_name) {
+                continue;
             }
+            contexts.push(get_security_context_for(&element_name, prop_name, version));
         }
     }
+    contexts
+}
 
-    // Determine the result based on what we found
-    if has_url && has_resource_url {
-        // Special case: property could be either URL or ResourceURL
-        // depending on the element (e.g., "src" on <img> vs <script>)
-        SecurityContext::UrlOrResourceUrl
-    } else if has_url {
-        SecurityContext::Url
-    } else if has_resource_url {
-        SecurityContext::ResourceUrl
-    } else if has_other {
-        other_context
+/// A bare selector element that is not in the DOM schema is rewritten to
+/// `:svg:name` or `:math:name` when that namespaced element exists.
+fn resolve_concrete_element(element: &str) -> Vec<String> {
+    if is_known_element(element) {
+        return vec![element.to_string()];
+    }
+    let lower = element.to_ascii_lowercase();
+    let svg = format!(":svg:{lower}");
+    let math = format!(":math:{lower}");
+    if is_known_element(&svg) {
+        vec![svg]
+    } else if is_known_element(&math) {
+        vec![math]
     } else {
-        SecurityContext::None
+        vec![element.to_string()]
+    }
+}
+
+fn qualify_with_selector_namespace(element_name: &str, namespace_key: Option<&str>) -> String {
+    let lower = element_name.to_ascii_lowercase();
+    let (own_ns, name) = split_ns_name(&lower);
+    let ns =
+        own_ns.map(str::to_ascii_lowercase).or_else(|| namespace_key.map(str::to_ascii_lowercase));
+    match ns {
+        Some(ns) if !ns.is_empty() => format!(":{ns}:{name}"),
+        _ => name.to_string(),
+    }
+}
+
+fn is_selector_ident_byte(b: u8) -> bool {
+    b.is_ascii_alphanumeric() || b == b'-' || b == b'_'
+}
+
+fn not_element_names(css: &CssSelector) -> FxHashSet<String> {
+    css.not_selectors
+        .iter()
+        .filter(|sel| {
+            sel.element.is_some()
+                && sel.class_names.is_empty()
+                && sel.attrs.is_empty()
+                && sel.not_selectors.is_empty()
+        })
+        .filter_map(|sel| sel.element.as_ref().map(|name| name.to_ascii_lowercase()))
+        .collect()
+}
+
+fn is_not_excluded(element_name: &str, excluded: &FxHashSet<String>) -> bool {
+    let lower = element_name.to_ascii_lowercase();
+    if excluded.contains(&lower) {
+        return false;
+    }
+    let local = split_ns_name(&lower).1.to_ascii_lowercase();
+    !excluded.contains(&local)
+}
+
+fn reduce_security_contexts(contexts: &[SecurityContext]) -> SecurityContext {
+    let mut present = Vec::new();
+    for ctx in contexts {
+        match *ctx {
+            SecurityContext::None => {}
+            SecurityContext::UrlOrResourceUrl => {
+                push_unique(&mut present, SecurityContext::Url);
+                push_unique(&mut present, SecurityContext::ResourceUrl);
+            }
+            other => push_unique(&mut present, other),
+        }
+    }
+
+    let has_url = present.contains(&SecurityContext::Url);
+    let has_resource_url = present.contains(&SecurityContext::ResourceUrl);
+    match present.as_slice() {
+        [] => SecurityContext::None,
+        [single] => *single,
+        _ if has_url && has_resource_url && present.len() == 2 => SecurityContext::UrlOrResourceUrl,
+        // Upstream throws on any other mix. Those mixes are not produced by the
+        // current schema; keep the lowest enum value so compilation still finishes.
+        many => many
+            .iter()
+            .copied()
+            .min_by_key(|ctx| security_context_rank(*ctx))
+            .unwrap_or(SecurityContext::None),
+    }
+}
+
+fn push_unique(contexts: &mut Vec<SecurityContext>, ctx: SecurityContext) {
+    if !contexts.contains(&ctx) {
+        contexts.push(ctx);
+    }
+}
+
+fn security_context_rank(ctx: SecurityContext) -> u8 {
+    match ctx {
+        SecurityContext::None => 0,
+        SecurityContext::Html => 1,
+        SecurityContext::Style => 2,
+        SecurityContext::Script => 3,
+        SecurityContext::Url => 4,
+        SecurityContext::ResourceUrl => 5,
+        SecurityContext::AttributeNoBinding => 6,
+        SecurityContext::UrlOrResourceUrl => 7,
     }
 }
 
@@ -292,22 +1084,45 @@ mod tests {
         assert_eq!(get_security_context("a", "href"), SecurityContext::Url);
         assert_eq!(get_security_context("form", "action"), SecurityContext::Url);
         assert_eq!(get_security_context("img", "src"), SecurityContext::Url);
+        assert_eq!(get_security_context(":svg:a", "href"), SecurityContext::Url);
+        assert_eq!(get_security_context(":math:mi", "href"), SecurityContext::Url);
+        // Bare MathML local names are not the schema key.
+        assert_eq!(get_security_context("mi", "href"), SecurityContext::None);
     }
 
     #[test]
     fn test_resource_url_context() {
-        assert_eq!(get_security_context("script", "src"), SecurityContext::ResourceUrl);
         assert_eq!(get_security_context("iframe", "src"), SecurityContext::ResourceUrl);
         assert_eq!(get_security_context("embed", "src"), SecurityContext::ResourceUrl);
+        // v22 dropped `script|src`. Script elements are stripped before binding.
+        assert_eq!(get_security_context("script", "src"), SecurityContext::None);
     }
 
     #[test]
-    fn test_attribute_no_binding_context() {
+    fn test_svg_animation_attribute_no_binding() {
+        assert_eq!(get_security_context(":svg:animate", "to"), SecurityContext::AttributeNoBinding);
+        assert_eq!(
+            get_security_context(":svg:animate", "from"),
+            SecurityContext::AttributeNoBinding
+        );
+        assert_eq!(
+            get_security_context(":svg:animate", "values"),
+            SecurityContext::AttributeNoBinding
+        );
         assert_eq!(
-            get_security_context("animate", "attributeName"),
+            get_security_context(":svg:animate", "attributeName"),
             SecurityContext::AttributeNoBinding
         );
+        assert_eq!(get_security_context(":svg:set", "to"), SecurityContext::AttributeNoBinding);
+        // The un-namespaced key is not registered. HTML `<animate>` is not the SVG element.
+        assert_eq!(get_security_context("animate", "to"), SecurityContext::None);
+        assert_eq!(get_security_context("animate", "attributeName"), SecurityContext::None);
+    }
+
+    #[test]
+    fn test_attribute_no_binding_context() {
         assert_eq!(get_security_context("iframe", "sandbox"), SecurityContext::AttributeNoBinding);
+        assert_eq!(get_security_context("unknown", "to"), SecurityContext::AttributeNoBinding);
     }
 
     #[test]
@@ -319,22 +1134,15 @@ mod tests {
     #[test]
     fn test_case_insensitivity() {
         assert_eq!(get_security_context("IFRAME", "SRCDOC"), SecurityContext::Html);
-        assert_eq!(get_security_context("Script", "Src"), SecurityContext::ResourceUrl);
+        assert_eq!(get_security_context(":SVG:Animate", "TO"), SecurityContext::AttributeNoBinding);
     }
 
     #[test]
     fn test_unknown_element_url_or_resource_url() {
-        // "src" can be either URL (img, video) or ResourceURL (script, embed, iframe, frame)
         assert_eq!(
             calc_security_context_for_unknown_element("src"),
             SecurityContext::UrlOrResourceUrl
         );
-    }
-
-    #[test]
-    fn test_unknown_element_just_url() {
-        // "href" on most elements is URL (but "base|href" and "link|href" are ResourceURL)
-        // So this should also be UrlOrResourceUrl
         assert_eq!(
             calc_security_context_for_unknown_element("href"),
             SecurityContext::UrlOrResourceUrl
@@ -343,13 +1151,373 @@ mod tests {
 
     #[test]
     fn test_unknown_element_html() {
-        // "innerHTML" is always Html (wildcard)
         assert_eq!(calc_security_context_for_unknown_element("innerHTML"), SecurityContext::Html);
     }
 
     #[test]
     fn test_unknown_element_none() {
-        // "class" has no security context
         assert_eq!(calc_security_context_for_unknown_element("class"), SecurityContext::None);
     }
+
+    #[test]
+    fn test_unknown_element_svg_animation_values() {
+        assert_eq!(
+            calc_security_context_for_unknown_element("to"),
+            SecurityContext::AttributeNoBinding
+        );
+    }
+
+    #[test]
+    fn test_host_selector_promotes_svg_animate() {
+        assert_eq!(
+            host_binding_security_context("animate", "to"),
+            SecurityContext::AttributeNoBinding
+        );
+        assert_eq!(host_binding_security_context("a", "href"), SecurityContext::Url);
+        assert_eq!(host_binding_security_context("img", "src"), SecurityContext::Url);
+        assert_eq!(host_binding_security_context("iframe", "src"), SecurityContext::ResourceUrl);
+    }
+
+    #[test]
+    fn test_host_not_selector_drops_the_only_contributor() {
+        assert_eq!(host_binding_security_context("[x]:not(object)", "data"), SecurityContext::None);
+        assert_eq!(
+            host_binding_security_context("[x]:not(img):not(video)", "src"),
+            SecurityContext::ResourceUrl
+        );
+    }
+
+    #[test]
+    fn test_host_universal_selector_expands_to_known_elements() {
+        // `*` never produces an element name upstream, so `*` / `*[x]` behave
+        // like an attribute-only selector and scan every known element.
+        for selector in ["*", "*[x]", "[x]"] {
+            assert_eq!(
+                host_binding_security_context(selector, "src"),
+                SecurityContext::UrlOrResourceUrl,
+                "{selector}"
+            );
+            assert_eq!(
+                host_binding_security_context(selector, "formAction"),
+                SecurityContext::Url,
+                "{selector}"
+            );
+        }
+        // Same expansion on the pre-namespaced lookup path.
+        let version = Some(crate::AngularVersion::new(21, 0, 1));
+        assert_eq!(
+            host_binding_security_context_for("*[x]", "src", version),
+            SecurityContext::UrlOrResourceUrl
+        );
+        // A `:not(...)`-only selector parses to a literal `*` element upstream
+        // and is looked up as the `*|attr` key, which has no `src` entry.
+        assert_eq!(host_binding_security_context("*:not(img)", "src"), SecurityContext::None);
+        assert_eq!(
+            host_binding_security_context(":not(img):not(video)", "src"),
+            SecurityContext::None
+        );
+    }
+
+    #[test]
+    fn test_host_selector_leading_not_is_not_a_namespace() {
+        // `:not(...)` is a pseudo-class, not a `:ns:` prefix.
+        assert_eq!(
+            host_binding_security_context(":not(img):not(video)", "src"),
+            SecurityContext::None
+        );
+        // A real `:svg:` prefix still namespaces the lookup.
+        assert_eq!(
+            host_binding_security_context(":svg:animate", "to"),
+            SecurityContext::AttributeNoBinding
+        );
+    }
+
+    #[test]
+    fn test_host_comma_selector_merges_url_kinds() {
+        assert_eq!(
+            host_binding_security_context("a, base", "href"),
+            SecurityContext::UrlOrResourceUrl
+        );
+    }
+
+    fn v21_2_7() -> Option<crate::AngularVersion> {
+        Some(crate::AngularVersion::new(21, 2, 7))
+    }
+
+    #[test]
+    fn v21_2_7_uses_bare_keys() {
+        let version = v21_2_7();
+        assert_eq!(
+            get_security_context_for("animate", "to", version),
+            SecurityContext::AttributeNoBinding
+        );
+        assert_eq!(get_security_context_for(":svg:animate", "to", version), SecurityContext::None);
+        assert_eq!(
+            get_security_context_for("script", "src", version),
+            SecurityContext::ResourceUrl
+        );
+        assert_eq!(
+            get_security_context_for("script", "href", version),
+            SecurityContext::ResourceUrl
+        );
+        assert_eq!(get_security_context_for("mi", "href", version), SecurityContext::Url);
+        assert_eq!(get_security_context_for(":math:mi", "href", version), SecurityContext::None);
+        assert_eq!(
+            host_binding_security_context_for("animate", "to", version),
+            SecurityContext::AttributeNoBinding
+        );
+        assert_eq!(
+            host_binding_security_context_for("[x]", "to", version),
+            SecurityContext::AttributeNoBinding
+        );
+    }
+
+    #[test]
+    fn v21_2_6_has_no_animation_value_sinks() {
+        let version = Some(crate::AngularVersion::new(21, 2, 6));
+        assert_eq!(get_security_context_for("animate", "to", version), SecurityContext::None);
+        assert_eq!(
+            get_security_context_for("animate", "attributeName", version),
+            SecurityContext::AttributeNoBinding
+        );
+        assert!(rejects_iframe_src_i18n(version));
+        assert_eq!(host_binding_security_context_for("[x]", "to", version), SecurityContext::None);
+    }
+
+    #[test]
+    fn v21_0_has_script_src_only() {
+        let version = Some(crate::AngularVersion::new(21, 0, 0));
+        assert_eq!(
+            get_security_context_for("script", "src", version),
+            SecurityContext::ResourceUrl
+        );
+        assert_eq!(get_security_context_for("script", "href", version), SecurityContext::None);
+        assert_eq!(
+            get_security_context_for("animate", "attributeName", version),
+            SecurityContext::None
+        );
+        assert!(!rejects_iframe_src_i18n(version));
+        assert!(!strips_namespaced_svg_script(version));
+    }
+
+    #[test]
+    fn v21_2_3_still_allows_iframe_src_i18n() {
+        assert!(!rejects_iframe_src_i18n(Some(crate::AngularVersion::new(21, 2, 3))));
+        assert!(rejects_iframe_src_i18n(Some(crate::AngularVersion::new(21, 2, 4))));
+    }
+
+    #[test]
+    fn v21_0_1_is_the_legacy_schema() {
+        let version = Some(crate::AngularVersion::new(21, 0, 1));
+        // Legacy URL keys exist, but the hardening had not landed yet.
+        assert_eq!(get_security_context_for("a", "ping", version), SecurityContext::Url);
+        assert_eq!(get_security_context_for("media", "src", version), SecurityContext::ResourceUrl);
+        assert_eq!(
+            get_security_context_for("applet", "code", version),
+            SecurityContext::ResourceUrl
+        );
+        assert_eq!(
+            get_security_context_for("script", "src", version),
+            SecurityContext::ResourceUrl
+        );
+        assert_eq!(get_security_context_for("a", "xlink:href", version), SecurityContext::None);
+        assert_eq!(get_security_context_for("mi", "href", version), SecurityContext::None);
+        assert_eq!(
+            get_security_context_for("animate", "attributeName", version),
+            SecurityContext::None
+        );
+        assert_eq!(get_security_context_for("iframe", "sandbox", version), SecurityContext::None);
+        assert_eq!(get_security_context_for("script", "href", version), SecurityContext::None);
+    }
+
+    #[test]
+    fn v21_0_2_hardens_but_keeps_legacy_keys() {
+        let version = Some(crate::AngularVersion::new(21, 0, 2));
+        assert_eq!(get_security_context_for("a", "xlink:href", version), SecurityContext::Url);
+        assert_eq!(get_security_context_for("mi", "href", version), SecurityContext::Url);
+        assert_eq!(
+            get_security_context_for("animate", "attributeName", version),
+            SecurityContext::AttributeNoBinding
+        );
+        assert_eq!(get_security_context_for("media", "src", version), SecurityContext::ResourceUrl);
+        // `script|href` only landed in 21.0.7.
+        assert_eq!(get_security_context_for("script", "href", version), SecurityContext::None);
+    }
+
+    #[test]
+    fn v21_0_6_drops_legacy_keys_without_script_href() {
+        let version = Some(crate::AngularVersion::new(21, 0, 6));
+        assert_eq!(get_security_context_for("a", "ping", version), SecurityContext::None);
+        assert_eq!(get_security_context_for("media", "src", version), SecurityContext::None);
+        assert_eq!(get_security_context_for("script", "href", version), SecurityContext::None);
+        assert_eq!(
+            get_security_context_for("script", "src", version),
+            SecurityContext::ResourceUrl
+        );
+        assert_eq!(get_security_context_for("mi", "href", version), SecurityContext::Url);
+        assert_eq!(
+            get_security_context_for("animate", "attributeName", version),
+            SecurityContext::AttributeNoBinding
+        );
+    }
+
+    #[test]
+    fn v20_3_16_has_script_href_and_legacy_keys() {
+        let version = Some(crate::AngularVersion::new(20, 3, 16));
+        // The legacy-key removal was never backported to 20.3.
+        assert_eq!(get_security_context_for("media", "src", version), SecurityContext::ResourceUrl);
+        assert_eq!(
+            get_security_context_for("script", "href", version),
+            SecurityContext::ResourceUrl
+        );
+        assert_eq!(
+            get_security_context_for("script", "xlink:href", version),
+            SecurityContext::ResourceUrl
+        );
+        assert!(!rejects_iframe_src_i18n(version));
+        assert!(rejects_iframe_src_i18n(Some(crate::AngularVersion::new(20, 3, 18))));
+    }
+
+    #[test]
+    fn v21_2_14_is_namespaced_without_svg_a() {
+        let version = Some(crate::AngularVersion::new(21, 2, 14));
+        assert_eq!(
+            get_security_context_for(":svg:animate", "to", version),
+            SecurityContext::AttributeNoBinding
+        );
+        // Bare `animate|to` is not a key in the namespaced schema.
+        assert_eq!(get_security_context_for("animate", "to", version), SecurityContext::None);
+        // `:svg:a|href` arrived in 21.2.15.
+        assert_eq!(get_security_context_for(":svg:a", "href", version), SecurityContext::None);
+        assert_eq!(get_security_context_for("script", "src", version), SecurityContext::None);
+        assert!(strips_namespaced_svg_script(version));
+        assert!(strips_namespaced_svg_style(version));
+    }
+
+    #[test]
+    fn v21_2_15_and_v20_3_22_add_svg_a() {
+        for version in [
+            crate::AngularVersion::new(21, 2, 15),
+            crate::AngularVersion::new(20, 3, 22),
+            crate::AngularVersion::new(20, 3, 23),
+        ] {
+            let version = Some(version);
+            assert_eq!(get_security_context_for(":svg:a", "href", version), SecurityContext::Url);
+            assert!(strips_namespaced_svg_script(version));
+        }
+        // `:svg:style` classification was reverted after 21.2.14 / 20.3.22.
+        assert!(!strips_namespaced_svg_style(Some(crate::AngularVersion::new(21, 2, 15))));
+        assert!(strips_namespaced_svg_style(Some(crate::AngularVersion::new(20, 3, 22))));
+        assert!(!strips_namespaced_svg_style(Some(crate::AngularVersion::new(20, 3, 23))));
+        assert!(!strips_namespaced_svg_style(None));
+    }
+
+    #[test]
+    fn v19_2_follows_the_same_backported_cutovers() {
+        // The 19.2 line received the same security backports as 20.3/21.x.
+        let v19_2_16 = Some(crate::AngularVersion::new(19, 2, 16));
+        assert_eq!(
+            get_security_context_for("media", "src", v19_2_16),
+            SecurityContext::ResourceUrl
+        );
+        assert_eq!(get_security_context_for("a", "xlink:href", v19_2_16), SecurityContext::None);
+        assert_eq!(get_security_context_for("script", "href", v19_2_16), SecurityContext::None);
+
+        // 19.2.17 hardened (MathML hrefs, attrNoBinding) but kept legacy keys.
+        let v19_2_17 = Some(crate::AngularVersion::new(19, 2, 17));
+        assert_eq!(get_security_context_for("a", "xlink:href", v19_2_17), SecurityContext::Url);
+        assert_eq!(get_security_context_for("mi", "href", v19_2_17), SecurityContext::Url);
+        assert_eq!(
+            get_security_context_for("iframe", "sandbox", v19_2_17),
+            SecurityContext::AttributeNoBinding
+        );
+        assert_eq!(
+            get_security_context_for("media", "src", v19_2_17),
+            SecurityContext::ResourceUrl
+        );
+        assert_eq!(get_security_context_for("script", "href", v19_2_17), SecurityContext::None);
+        assert!(!rejects_iframe_src_i18n(v19_2_17));
+
+        // 19.2.18+ added `script|href`; `iframe|src` joined the Trusted Types
+        // sinks at 19.2.20.
+        let v19_2_19 = Some(crate::AngularVersion::new(19, 2, 19));
+        assert_eq!(
+            get_security_context_for("script", "href", v19_2_19),
+            SecurityContext::ResourceUrl
+        );
+        assert!(!rejects_iframe_src_i18n(v19_2_19));
+        assert!(rejects_iframe_src_i18n(Some(crate::AngularVersion::new(19, 2, 20))));
+
+        // 19.2.23+ has the namespaced schema with `:svg:a|href`; `:svg:style`
+        // was stripped in exactly 19.2.23.
+        let v19_2_23 = Some(crate::AngularVersion::new(19, 2, 23));
+        assert!(uses_namespaced_schema(v19_2_23));
+        assert_eq!(get_security_context_for(":svg:a", "href", v19_2_23), SecurityContext::Url);
+        assert_eq!(get_security_context_for("script", "src", v19_2_23), SecurityContext::None);
+        assert!(strips_namespaced_svg_script(v19_2_23));
+        assert!(strips_namespaced_svg_style(v19_2_23));
+        let v19_2_24 = Some(crate::AngularVersion::new(19, 2, 24));
+        assert!(uses_namespaced_schema(v19_2_24));
+        assert!(!strips_namespaced_svg_style(v19_2_24));
+
+        // 19.0 / 19.1 are the legacy schema.
+        for version in [crate::AngularVersion::new(19, 0, 0), crate::AngularVersion::new(19, 1, 4)]
+        {
+            let version = Some(version);
+            assert!(!uses_namespaced_schema(version));
+            assert_eq!(
+                get_security_context_for("media", "src", version),
+                SecurityContext::ResourceUrl
+            );
+        }
+    }
+
+    #[test]
+    fn iframe_attr_validation_only_on_the_legacy_schema() {
+        assert!(uses_iframe_attr_validation(Some(crate::AngularVersion::new(19, 0, 0))));
+        assert!(uses_iframe_attr_validation(Some(crate::AngularVersion::new(19, 2, 16))));
+        assert!(!uses_iframe_attr_validation(Some(crate::AngularVersion::new(19, 2, 17))));
+        assert!(uses_iframe_attr_validation(Some(crate::AngularVersion::new(20, 3, 14))));
+        assert!(!uses_iframe_attr_validation(Some(crate::AngularVersion::new(20, 3, 15))));
+        assert!(uses_iframe_attr_validation(Some(crate::AngularVersion::new(21, 0, 1))));
+        assert!(!uses_iframe_attr_validation(Some(crate::AngularVersion::new(21, 0, 2))));
+        assert!(!uses_iframe_attr_validation(None));
+        assert!(!uses_iframe_attr_validation(Some(crate::AngularVersion::new(22, 0, 0))));
+    }
+
+    #[test]
+    fn v21_2_14_looks_up_the_tag_verbatim() {
+        // 21.2.14 has the namespaced schema keys but `securityContext` had no
+        // `normalizeTagName` yet: the tag is lowercased verbatim.
+        let v21_2_14 = Some(crate::AngularVersion::new(21, 2, 14));
+        assert_eq!(get_security_context_for(":xml:iframe", "src", v21_2_14), SecurityContext::None);
+        assert_eq!(
+            get_security_context_for(":svg:animate", "to", v21_2_14),
+            SecurityContext::AttributeNoBinding
+        );
+        // 21.2.15+ normalizes `:xml:iframe` down to `iframe`.
+        let v21_2_15 = Some(crate::AngularVersion::new(21, 2, 15));
+        assert_eq!(
+            get_security_context_for(":xml:iframe", "src", v21_2_15),
+            SecurityContext::ResourceUrl
+        );
+        // Pre-namespaced versions never normalized either.
+        let v21_2_13 = Some(crate::AngularVersion::new(21, 2, 13));
+        assert_eq!(get_security_context_for(":xml:iframe", "src", v21_2_13), SecurityContext::None);
+        assert_eq!(get_security_context_for(":svg:animate", "to", v21_2_13), SecurityContext::None);
+    }
+
+    #[test]
+    fn iframe_security_sensitive_attrs_match_case_insensitively() {
+        for attr in
+            ["sandbox", "allow", "allowfullscreen", "referrerpolicy", "csp", "fetchpriority"]
+        {
+            assert!(is_iframe_security_sensitive_attr(attr));
+        }
+        // `setAttribute` lowercases the name, so upstream compares lowercase.
+        assert!(is_iframe_security_sensitive_attr("SandBox"));
+        assert!(is_iframe_security_sensitive_attr("allowFullScreen"));
+        assert!(!is_iframe_security_sensitive_attr("src"));
+        assert!(!is_iframe_security_sensitive_attr("srcdoc"));
+    }
 }
diff --git a/crates/oxc_angular_compiler/src/schema/mod.rs b/crates/oxc_angular_compiler/src/schema/mod.rs
index 4a3a14d89..0c7b2f1cc 100644
--- a/crates/oxc_angular_compiler/src/schema/mod.rs
+++ b/crates/oxc_angular_compiler/src/schema/mod.rs
@@ -4,5 +4,13 @@
 //! and security contexts.
 
 mod dom_security_schema;
+mod trusted_types_sinks;
 
-pub use dom_security_schema::{calc_security_context_for_unknown_element, get_security_context};
+pub use dom_security_schema::{
+    calc_security_context_for_unknown_element, get_security_context, get_security_context_for,
+    host_binding_security_context, host_binding_security_context_for,
+    is_iframe_security_sensitive_attr, is_known_element, rejects_iframe_src_i18n,
+    strips_namespaced_svg_script, strips_namespaced_svg_style, uses_iframe_attr_validation,
+    uses_namespaced_schema,
+};
+pub use trusted_types_sinks::{is_trusted_types_sink, is_trusted_types_sink_at};
diff --git a/crates/oxc_angular_compiler/src/schema/trusted_types_sinks.rs b/crates/oxc_angular_compiler/src/schema/trusted_types_sinks.rs
new file mode 100644
index 000000000..882f733ec
--- /dev/null
+++ b/crates/oxc_angular_compiler/src/schema/trusted_types_sinks.rs
@@ -0,0 +1,77 @@
+//! Trusted Types sinks.
+//!
+//! Ported from `@angular/compiler` `schema/trusted_types_sinks.ts`.
+//! Tag and property names are lowercased. Namespace prefixes are not stripped:
+//! `:svg:iframe|src` is not the `iframe|src` sink.
+
+/// `tag|property` pairs that must not be rewritten by i18n.
+/// Every entry is lowercase. `*` applies to every tag.
+const TRUSTED_TYPES_SINKS: &[&str] = &[
+    "iframe|srcdoc",
+    "*|innerhtml",
+    "*|outerhtml",
+    "embed|src",
+    "iframe|src",
+    "object|codebase",
+    "object|data",
+];
+
+/// Whether `prop_name` on `tag_name` is a Trusted Types sink on the latest schema.
+pub fn is_trusted_types_sink(tag_name: &str, prop_name: &str) -> bool {
+    is_trusted_types_sink_at(tag_name, prop_name, None)
+}
+
+/// Trusted Types sink check for a specific Angular version.
+///
+/// `iframe|src` is rejected from 21.2.4 onward. Earlier compilers allow it.
+pub fn is_trusted_types_sink_at(
+    tag_name: &str,
+    prop_name: &str,
+    version: Option<crate::AngularVersion>,
+) -> bool {
+    let tag_name = tag_name.to_ascii_lowercase();
+    let prop_name = prop_name.to_ascii_lowercase();
+    if tag_name == "iframe" && prop_name == "src" && !super::rejects_iframe_src_i18n(version) {
+        return false;
+    }
+    let specific = format!("{tag_name}|{prop_name}");
+    let wildcard = format!("*|{prop_name}");
+    TRUSTED_TYPES_SINKS.iter().any(|sink| *sink == specific || *sink == wildcard)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn iframe_src_is_a_sink() {
+        assert!(is_trusted_types_sink("iframe", "src"));
+        assert!(is_trusted_types_sink("IFRAME", "SRC"));
+        assert!(is_trusted_types_sink("div", "innerHTML"));
+    }
+
+    #[test]
+    fn namespaced_tag_is_not_rewritten_to_the_local_name() {
+        assert!(!is_trusted_types_sink(":svg:iframe", "src"));
+        assert!(!is_trusted_types_sink("div", "title"));
+    }
+
+    #[test]
+    fn iframe_src_sink_starts_at_21_2_4() {
+        assert!(!is_trusted_types_sink_at(
+            "iframe",
+            "src",
+            Some(crate::AngularVersion::new(21, 2, 3))
+        ));
+        assert!(is_trusted_types_sink_at(
+            "iframe",
+            "src",
+            Some(crate::AngularVersion::new(21, 2, 4))
+        ));
+        assert!(is_trusted_types_sink_at(
+            "iframe",
+            "srcdoc",
+            Some(crate::AngularVersion::new(21, 0, 0))
+        ));
+    }
+}
diff --git a/crates/oxc_angular_compiler/src/transform/html_to_r3.rs b/crates/oxc_angular_compiler/src/transform/html_to_r3.rs
index f4a139475..a70c31055 100644
--- a/crates/oxc_angular_compiler/src/transform/html_to_r3.rs
+++ b/crates/oxc_angular_compiler/src/transform/html_to_r3.rs
@@ -10,6 +10,7 @@ use oxc_span::Span;
 use oxc_str::Ident;
 use rustc_hash::{FxHashMap, FxHashSet};
 
+use crate::AngularVersion;
 use crate::ast::expression::{
     AbsoluteSourceSpan, AngularExpression, BindingType, ParseSpan, ParsedEventType,
 };
@@ -28,8 +29,11 @@ use crate::ast::r3::{
 use crate::i18n::parser::I18nMessageFactory;
 use crate::i18n::placeholder::PlaceholderRegistry;
 use crate::parser::expression::{BindingParser, find_comment_start};
-use crate::parser::html::decode_entities_in_string;
-use crate::schema::get_security_context;
+use crate::parser::html::{decode_entities_in_string, get_html_tag_definition, split_ns_name};
+use crate::schema::{
+    get_security_context_for, is_known_element, is_trusted_types_sink_at,
+    strips_namespaced_svg_script, strips_namespaced_svg_style, uses_namespaced_schema,
+};
 use crate::transform::control_flow::{parse_conditional_params, parse_defer_triggers};
 use crate::util::ParseError;
 
@@ -98,6 +102,8 @@ struct TemplateAttrInfo<'a> {
 pub struct TransformOptions {
     /// Whether to collect comment nodes.
     pub collect_comment_nodes: bool,
+    /// Angular version being compiled. `None` uses the latest (v22) security schema.
+    pub angular_version: Option<AngularVersion>,
 }
 
 /// Inserts or updates a var entry in an ordered Vec, preserving first-insertion order.
@@ -143,7 +149,9 @@ pub struct HtmlToR3Transform<'a> {
     ng_content_selectors: Vec<'a, Ident<'a>>,
     comment_nodes: Option<Vec<'a, R3Comment<'a>>>,
     processed_nodes: FxHashSet<usize>,
-    namespace_stack: std::vec::Vec<ElementNamespace>,
+    /// Prefix each open element passes to its children (`svg`, `math`, `xml`,
+    /// or empty), matching `getNsPrefix(parentName)` in `_getPrefix`.
+    namespace_stack: std::vec::Vec<String>,
     /// Depth counter for ngNonBindable. When > 0, bindings are suppressed.
     non_bindable_depth: u32,
     /// Depth counter for i18n context. When > 0, ICU expansions are emitted.
@@ -156,6 +164,8 @@ pub struct HtmlToR3Transform<'a> {
     /// Placeholder registry for generating unique tag placeholder names within i18n blocks.
     /// Reset when entering a new i18n block.
     i18n_placeholder_registry: PlaceholderRegistry,
+    /// Angular version for security-schema and script-stripping compatibility.
+    angular_version: Option<AngularVersion>,
     /// Counter for generating unique i18n message instance IDs.
     ///
     /// Each i18n message gets a unique instance ID that's used to track message identity
@@ -165,13 +175,6 @@ pub struct HtmlToR3Transform<'a> {
     i18n_message_instance_counter: u32,
 }
 
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-enum ElementNamespace {
-    Html,
-    Svg,
-    Math,
-}
-
 impl<'a> HtmlToR3Transform<'a> {
     /// Creates a new HTML to R3 transformer.
     pub fn new(allocator: &'a Allocator, source_text: &'a str, options: TransformOptions) -> Self {
@@ -195,9 +198,14 @@ impl<'a> HtmlToR3Transform<'a> {
             icu_placeholder_counts: FxHashMap::default(),
             i18n_placeholder_registry: PlaceholderRegistry::new(),
             i18n_message_instance_counter: 0,
+            angular_version: options.angular_version,
         }
     }
 
+    fn security_context(&self, element: &str, property: &str) -> SecurityContext {
+        get_security_context_for(element, property, self.angular_version)
+    }
+
     /// Allocates a new unique instance ID for an i18n message.
     fn allocate_i18n_message_instance_id(&mut self) -> u32 {
         let id = self.i18n_message_instance_counter;
@@ -308,53 +316,110 @@ impl<'a> HtmlToR3Transform<'a> {
     fn visit_element(&mut self, element: &HtmlElement<'a>) -> Option<R3Node<'a>> {
         let raw_name = element.name.as_str();
 
-        // Check for special elements. `<script>`/`<style>` are only treated
-        // specially in the HTML namespace: Angular classifies them by the
-        // lowercased element name, so a namespaced SVG `<style>` (`:svg:style`)
-        // is a normal element, not a stylesheet to extract (v22 conformance).
-        let in_html_namespace = self.current_namespace() == ElementNamespace::Html;
-        if in_html_namespace && raw_name == "script" {
-            return None;
-        }
-        if in_html_namespace && raw_name == "style" {
-            // Extract style content
-            if let Some(content) = self.get_text_content(element) {
-                self.styles.push(content);
+        // Angular's parser bakes the namespace into the element name with
+        // `_getPrefix` + `mergeNsAndName` (`:svg:rect`, `:xml:div`). The parser
+        // here keeps the local name plus an explicit `:ns:` prefix, so the
+        // upstream name is reconstructed and the inherited prefix is tracked
+        // on a stack.
+        let parent_prefix = self.current_prefix();
+        // `<MyComp:iframe>` keeps the class in `name`. The host tag is what
+        // `isTrustedTypesSink` and the binding security lookup see, including an
+        // explicit prefix and a prefix inherited from the parent
+        // (`:svg:ng-component`, `:svg:iframe`). No prefix and no local tag is
+        // `tagName === null`.
+        let host_tag = if element.is_component {
+            Self::selectorless_host_tag(element, parent_prefix)
+        } else {
+            None
+        };
+        // `_getPrefix`: the explicit `:ns:` prefix wins, then the tag's implicit
+        // namespace (`svg`, `math`, `foreignObject`), then the parent's prefix —
+        // kept verbatim, so arbitrary prefixes like `:xml:` inherit too.
+        let resolved_name = if element.is_component {
+            String::new()
+        } else {
+            Self::resolve_element_name(raw_name, parent_prefix)
+        };
+        let security_name = if element.is_component {
+            Self::component_security_name(host_tag.as_deref(), self.angular_version)
+        } else {
+            // The security lookup gets the verbatim resolved name;
+            // `get_security_context_for` decides per target version whether
+            // `normalizeTagName` strips non-svg/math prefixes.
+            resolved_name.clone()
+        };
+        // Trusted Types and the script/style sets use the parser's full name.
+        let qualified_name = resolved_name.to_ascii_lowercase();
+        // Children inherit this element's own resolved prefix, or nothing when
+        // its tag definition prevents namespace inheritance (`foreignObject`) or
+        // the host tag is `tagName === null`.
+        let child_prefix = if element.is_component {
+            Self::component_child_prefix(host_tag.as_deref())
+        } else {
+            Self::inheritable_prefix(&resolved_name)
+        };
+
+        if element.is_component {
+            // `visitComponent` does not run the element preparser. A class named
+            // `Script` is not an HTML script. Unsupported hosts are the host tag
+            // (`<MyComp:script>`), not the class.
+            if let Some(tag) = host_tag.as_deref()
+                && UNSUPPORTED_SELECTORLESS_TAGS.contains(&tag)
+            {
+                self.report_error(
+                    &format!("Tag name \"{tag}\" cannot be used as a component tag"),
+                    element.start_span,
+                );
+                return None;
             }
-            return None;
-        }
-        if raw_name == "link" {
-            // Collect stylesheet URLs
-            if let Some(href) = self.get_stylesheet_href(element) {
-                self.style_urls.push(href);
+        } else {
+            // HTML `<script>` is always stripped. `:svg:script` is stripped from
+            // v22 (`SCRIPT_ELEMENTS`). Other prefixes, such as `:xml:script`, stay.
+            if qualified_name == "script"
+                || (strips_namespaced_svg_script(self.angular_version)
+                    && qualified_name == ":svg:script")
+            {
+                return None;
             }
-            // Filter out <link rel="stylesheet"> inside ngNonBindable elements
-            if self.non_bindable_depth > 0 && self.is_stylesheet_link(element) {
+            // The preparser classified `:svg:style` as a style element only on
+            // 20.3.22 and 21.2.14 (`STYLE_ELEMENTS`); elsewhere it stays an
+            // ordinary element.
+            if qualified_name == "style"
+                || (strips_namespaced_svg_style(self.angular_version)
+                    && qualified_name == ":svg:style")
+            {
+                if let Some(content) = self.get_text_content(element) {
+                    self.styles.push(content);
+                }
                 return None;
             }
+            if raw_name == "link" {
+                // Collect stylesheet URLs
+                if let Some(href) = self.get_stylesheet_href(element) {
+                    self.style_urls.push(href);
+                }
+                // Filter out <link rel="stylesheet"> inside ngNonBindable elements
+                if self.non_bindable_depth > 0 && self.is_stylesheet_link(element) {
+                    return None;
+                }
+            }
         }
 
+        let i18n_element_name =
+            if element.is_component { host_tag.as_deref() } else { Some(qualified_name.as_str()) };
+
         // Parse attributes
-        let (attributes, inputs, outputs, references, variables, template_attr) =
-            self.parse_attributes(&element.attrs, raw_name, raw_name == "ng-template");
-
-        // Resolve namespace for this element and its children.
-        // Note: foreignObject is an SVG element but its children use HTML namespace.
-        // We need to distinguish between the element's own namespace (for naming) and
-        // the namespace for its children (pushed to stack).
-        let parent_namespace = self.current_namespace();
-        let child_namespace = self.resolve_namespace(raw_name, parent_namespace);
-
-        // For foreignObject in SVG context: the element itself is SVG, only children are HTML.
-        // For all other elements: element namespace equals child namespace.
-        let element_namespace = if parent_namespace == ElementNamespace::Svg
-            && raw_name.eq_ignore_ascii_case("foreignObject")
-        {
-            ElementNamespace::Svg
-        } else {
-            child_namespace
-        };
-        self.namespace_stack.push(child_namespace);
+        let (attributes, inputs, outputs, references, variables, template_attr) = self
+            .parse_attributes(
+                &element.attrs,
+                &security_name,
+                i18n_element_name,
+                raw_name == "ng-template",
+            );
+
+        // `child_prefix` is what children inherit; `foreignObject` already
+        // resolves to `:svg:foreignObject` and passes nothing on.
+        self.namespace_stack.push(child_prefix);
 
         // Check if element has ngNonBindable attribute
         let has_non_bindable =
@@ -461,7 +526,7 @@ impl<'a> HtmlToR3Transform<'a> {
         self.namespace_stack.pop();
 
         // Transform selectorless directives from HTML AST
-        let directives = self.transform_directives(&element.directives, raw_name);
+        let directives = self.transform_directives(&element.directives, &security_name);
 
         // Determine if element is self-closing (explicitly closed with />)
         let is_self_closing = element.is_self_closing;
@@ -521,7 +586,7 @@ impl<'a> HtmlToR3Transform<'a> {
 
         // Check for ng-template
         if raw_name == "ng-template" {
-            let name = self.qualify_element_name(element.name, element_namespace);
+            let name = Ident::from_in(resolved_name.as_str(), &self.allocator);
             let template = R3Template {
                 tag_name: Some(name),
                 attributes,
@@ -562,40 +627,32 @@ impl<'a> HtmlToR3Transform<'a> {
             }
         }
 
-        let name = self.qualify_element_name(element.name, element_namespace);
+        let name = Ident::from_in(resolved_name.as_str(), &self.allocator);
 
         // Check if this is a component (uppercase first letter or underscore)
         let first_char = raw_name.chars().next().unwrap_or('a');
         let is_component = first_char.is_ascii_uppercase() || first_char == '_';
 
         let mut result = if is_component {
-            // Validate selectorless component - check for unsupported tags
-            let tag_name_lower = raw_name.to_ascii_lowercase();
-            if UNSUPPORTED_SELECTORLESS_TAGS.contains(&tag_name_lower.as_str()) {
-                self.report_error(
-                    &format!("Tag name \"{raw_name}\" cannot be used as a component tag"),
-                    element.start_span,
-                );
-                return None;
+            // Parsed components already checked the host tag. An uppercase element
+            // from a non-selectorless parse (`<Link>`) still uses the element name.
+            if !element.is_component {
+                let tag_name_lower = raw_name.to_ascii_lowercase();
+                if UNSUPPORTED_SELECTORLESS_TAGS.contains(&tag_name_lower.as_str()) {
+                    self.report_error(
+                        &format!("Tag name \"{raw_name}\" cannot be used as a component tag"),
+                        element.start_span,
+                    );
+                    return None;
+                }
             }
 
             // Validate selectorless references
             self.validate_selectorless_references(&references);
 
-            // Compute tag_name from component_prefix and component_tag_name
-            // Format: ":prefix:tag_name" (e.g., ":svg:rect") or just "tag_name"
-            let tag_name = match (&element.component_prefix, &element.component_tag_name) {
-                (None, None) => None,
-                (None, Some(tag)) => Some(*tag),
-                (Some(prefix), None) => {
-                    // Has prefix but no tag name - use "ng-component" as default
-                    Some(Ident::from_in(&format!(":{prefix}:ng-component"), &self.allocator))
-                }
-                (Some(prefix), Some(tag)) => {
-                    // Both prefix and tag name: ":prefix:tag_name"
-                    Some(Ident::from_in(&format!(":{prefix}:{tag}"), &self.allocator))
-                }
-            };
+            // `tagName` is the resolved host tag (`_getComponentTagName`), so it
+            // carries an explicit, implicit, or inherited prefix.
+            let tag_name = host_tag.map(|tag| Ident::from_in(tag.as_str(), &self.allocator));
 
             // Compute full_name: "ComponentName:prefix:tag_name" or "ComponentName:tag_name"
             let full_name = match &tag_name {
@@ -642,7 +699,7 @@ impl<'a> HtmlToR3Transform<'a> {
                 source_span: element.span,
                 start_source_span: element.start_span,
                 end_source_span: element.end_span,
-                is_void: self.is_void_element(element.name.as_str()),
+                is_void: self.is_void_element(resolved_name.as_str()),
                 i18n: i18n_meta,
             };
             R3Node::Element(Box::new_in(r3_element, &self.allocator))
@@ -658,15 +715,29 @@ impl<'a> HtmlToR3Transform<'a> {
 
     /// Visits an HTML component (selectorless component AST node).
     fn visit_html_component(&mut self, component: &HtmlComponent<'a>) -> Option<R3Node<'a>> {
-        // Parse attributes
+        let parent_prefix = self.current_prefix();
+        let host_tag = Self::component_node_host_tag(component, parent_prefix);
+        if let Some(tag) = host_tag.as_deref()
+            && UNSUPPORTED_SELECTORLESS_TAGS.contains(&tag)
+        {
+            self.report_error(
+                &format!("Tag name \"{tag}\" cannot be used as a component tag"),
+                component.start_span,
+            );
+            return None;
+        }
+
+        // `tagName === null` is not a Trusted Types sink. `full_name` is the class.
+        let i18n_element_name = host_tag.as_deref();
+        let security_name =
+            Self::component_security_name(host_tag.as_deref(), self.angular_version);
         let (attributes, inputs, outputs, references, _variables, template_attr) =
-            self.parse_attributes(&component.attrs, component.full_name.as_str(), false);
+            self.parse_attributes(&component.attrs, &security_name, i18n_element_name, false);
 
-        // Resolve namespace for this component and its children.
-        let parent_namespace = self.current_namespace();
-        let element_namespace =
-            self.resolve_namespace(component.full_name.as_str(), parent_namespace);
-        self.namespace_stack.push(element_namespace);
+        // Children inherit the host tag's prefix verbatim (`_getPrefix` uses
+        // `component.tagName` as the parent name), honoring
+        // `preventNamespaceInheritance` on hosts like `foreignObject`.
+        self.namespace_stack.push(Self::component_child_prefix(host_tag.as_deref()));
 
         // Check if component has ngNonBindable attribute
         let has_non_bindable =
@@ -706,10 +777,8 @@ impl<'a> HtmlToR3Transform<'a> {
         self.namespace_stack.pop();
 
         // Transform selectorless directives from HTML AST
-        // For components, tag_name may be None (e.g., `<MyComp>`), in which case we use empty string
-        // which matches TypeScript's behavior where elementName can be null.
-        let element_name = component.tag_name.as_ref().map_or("", Ident::as_str);
-        let directives = self.transform_directives(&component.directives, element_name);
+        // `security_name` is empty when the host tag is `tagName === null`.
+        let directives = self.transform_directives(&component.directives, &security_name);
 
         // Validate selectorless references
         self.validate_selectorless_references(&references);
@@ -741,83 +810,127 @@ impl<'a> HtmlToR3Transform<'a> {
         Some(result)
     }
 
-    fn current_namespace(&self) -> ElementNamespace {
-        self.namespace_stack.last().copied().unwrap_or(ElementNamespace::Html)
+    /// Prefix inherited from the innermost open element (`""` at the root).
+    fn current_prefix(&self) -> &str {
+        self.namespace_stack.last().map_or("", String::as_str)
     }
 
-    fn resolve_namespace(&self, raw_name: &str, parent: ElementNamespace) -> ElementNamespace {
-        if let Some(explicit) = Self::namespace_from_prefixed_name(raw_name) {
-            return explicit;
+    /// `_getPrefix` + `mergeNsAndName`: explicit `:ns:` prefix, then the tag's
+    /// `implicitNamespacePrefix`, then the parent's prefix kept verbatim so
+    /// arbitrary prefixes (`:xml:div`) inherit.
+    fn resolve_element_name(raw_name: &str, parent_prefix: &str) -> String {
+        let (explicit_ns, local) = split_ns_name(raw_name);
+        if let Some(prefix) = explicit_ns {
+            return format!(":{prefix}:{local}");
         }
+        let prefix = get_html_tag_definition(local)
+            .implicit_namespace_prefix
+            .map_or_else(|| parent_prefix.to_string(), str::to_string);
+        if prefix.is_empty() { local.to_string() } else { format!(":{prefix}:{local}") }
+    }
 
-        if raw_name.eq_ignore_ascii_case("svg") {
-            return ElementNamespace::Svg;
-        }
-        if raw_name.eq_ignore_ascii_case("math") {
-            return ElementNamespace::Math;
+    /// Prefix this element passes on to its children. `foreignObject` (and any
+    /// other tag with `preventNamespaceInheritance`) passes nothing.
+    fn inheritable_prefix(resolved_name: &str) -> String {
+        let (ns, local) = split_ns_name(resolved_name);
+        if get_html_tag_definition(local).prevent_namespace_inheritance {
+            return String::new();
         }
+        ns.unwrap_or("").to_string()
+    }
 
-        match parent {
-            ElementNamespace::Svg => {
-                if raw_name.eq_ignore_ascii_case("foreignObject") {
-                    ElementNamespace::Html
-                } else {
-                    ElementNamespace::Svg
-                }
-            }
-            ElementNamespace::Math => ElementNamespace::Math,
-            ElementNamespace::Html => ElementNamespace::Html,
+    /// Host tag of a selectorless component, matching Angular's `tagName`.
+    ///
+    /// Prefix order matches `_getPrefix`: explicit prefix, then the host tag's
+    /// implicit namespace (`svg`, `math`, `foreignObject`), then the parent's
+    /// prefix verbatim. A prefix with no local tag becomes `ng-component`. No
+    /// prefix and no local tag is `tagName === null`.
+    fn selectorless_host_tag(element: &HtmlElement<'a>, parent_prefix: &str) -> Option<String> {
+        Self::canonical_host_tag(
+            element.component_prefix.as_ref().map(|prefix| prefix.as_str()),
+            element.component_tag_name.as_ref().map(|tag| tag.as_str()),
+            parent_prefix,
+        )
+    }
+
+    /// `HtmlComponent.tag_name` is either already `:ns:local` or a local name.
+    fn component_node_host_tag(
+        component: &HtmlComponent<'a>,
+        parent_prefix: &str,
+    ) -> Option<String> {
+        match component.tag_name.as_ref().map(|tag| tag.as_str()) {
+            Some(tag) if tag.starts_with(':') => Some(tag.to_string()),
+            other => Self::canonical_host_tag(None, other, parent_prefix),
         }
     }
 
-    fn namespace_from_prefixed_name(raw_name: &str) -> Option<ElementNamespace> {
-        if raw_name.starts_with(':')
-            && let Some((prefix, _)) = raw_name[1..].split_once(':')
+    fn canonical_host_tag(
+        explicit_prefix: Option<&str>,
+        local_tag: Option<&str>,
+        parent_prefix: &str,
+    ) -> Option<String> {
+        let mut prefix = explicit_prefix.unwrap_or("").to_string();
+        if prefix.is_empty()
+            && let Some(tag) = local_tag
+            && let Some(implicit) = get_html_tag_definition(tag).implicit_namespace_prefix
         {
-            return Self::namespace_from_prefix(prefix);
+            prefix = implicit.to_string();
         }
-
-        if let Some((prefix, _)) = raw_name.split_once(':') {
-            return Self::namespace_from_prefix(prefix);
+        if prefix.is_empty() {
+            prefix = parent_prefix.to_string();
         }
-
-        None
-    }
-
-    fn namespace_from_prefix(prefix: &str) -> Option<ElementNamespace> {
-        if prefix.eq_ignore_ascii_case("svg") {
-            Some(ElementNamespace::Svg)
-        } else if prefix.eq_ignore_ascii_case("math") {
-            Some(ElementNamespace::Math)
-        } else {
-            None
+        match (prefix.is_empty(), local_tag) {
+            (true, None) => None,
+            (true, Some(tag)) => Some(tag.to_string()),
+            (false, local) => {
+                let local = local.unwrap_or("ng-component");
+                Some(format!(":{prefix}:{local}"))
+            }
         }
     }
 
-    fn qualify_element_name(&self, name: Ident<'a>, namespace: ElementNamespace) -> Ident<'a> {
-        if namespace == ElementNamespace::Html {
-            return name;
+    /// Prefix a selectorless component passes to its children. `tagName ===
+    /// null` and hosts with `preventNamespaceInheritance` pass nothing.
+    fn component_child_prefix(host_tag: Option<&str>) -> String {
+        let Some(tag) = host_tag else {
+            return String::new();
+        };
+        let (ns, local) = split_ns_name(tag);
+        if get_html_tag_definition(local).prevent_namespace_inheritance {
+            return String::new();
         }
+        ns.unwrap_or("").to_string()
+    }
 
-        let name_str = name.as_str();
-        if name_str.starts_with(':') {
-            return name;
+    /// Security-schema name for a selectorless component, matching
+    /// `calcPossibleSecurityContexts(component.tagName, ...)`.
+    ///
+    /// On the namespaced schema a bare host tag that is not an HTML element is
+    /// rewritten to its known `:svg:`/`:math:` form (`animate` →
+    /// `:svg:animate`); pre-v22 versions look up the bare tag (`animate|to`).
+    /// `tagName === null` resolves over every known element upstream; the empty
+    /// name reproduces that through the `*|attr` fallback (`src` → `NONE`,
+    /// `innerHTML` → `HTML`).
+    fn component_security_name(host_tag: Option<&str>, version: Option<AngularVersion>) -> String {
+        let Some(tag) = host_tag else {
+            return String::new();
+        };
+        if !uses_namespaced_schema(version) {
+            return tag.to_string();
         }
-
-        if let Some((prefix, local)) = name_str.split_once(':')
-            && Self::namespace_from_prefix(prefix).is_some()
-        {
-            let qualified = format!(":{prefix}:{local}");
-            return Ident::from_in(&qualified, &self.allocator);
+        let lower = tag.to_ascii_lowercase();
+        let (ns, local) = split_ns_name(&lower);
+        if ns.is_none() && !is_known_element(local) {
+            let svg = format!(":svg:{local}");
+            if is_known_element(&svg) {
+                return svg;
+            }
+            let math = format!(":math:{local}");
+            if is_known_element(&math) {
+                return math;
+            }
         }
-
-        let ns = match namespace {
-            ElementNamespace::Svg => "svg",
-            ElementNamespace::Math => "math",
-            ElementNamespace::Html => return name,
-        };
-        let qualified = format!(":{ns}:{name_str}");
-        Ident::from_in(&qualified, &self.allocator)
+        tag.to_string()
     }
 
     /// Transforms HTML directives to R3 directives.
@@ -955,7 +1068,7 @@ impl<'a> HtmlToR3Transform<'a> {
                                 key_span: attr.name_span,
                                 value_span: Some(value_span),
                                 i18n: None,
-                                security_context: get_security_context(element_name, prop_name),
+                                security_context: self.security_context(element_name, prop_name),
                             });
                         }
                         BindingPrefix::On => {
@@ -990,7 +1103,7 @@ impl<'a> HtmlToR3Transform<'a> {
                                 key_span: attr.name_span,
                                 value_span: Some(value_span),
                                 i18n: None,
-                                security_context: get_security_context(element_name, rest),
+                                security_context: self.security_context(element_name, rest),
                             });
 
                             // Two-way binding also creates an output event
@@ -1056,7 +1169,7 @@ impl<'a> HtmlToR3Transform<'a> {
                         key_span: attr.name_span,
                         value_span: Some(value_span),
                         i18n: None,
-                        security_context: get_security_context(element_name, prop_name),
+                        security_context: self.security_context(element_name, prop_name),
                     });
 
                     // Two-way binding also creates an output event
@@ -1127,7 +1240,7 @@ impl<'a> HtmlToR3Transform<'a> {
                         key_span: attr.name_span,
                         value_span: Some(value_span),
                         i18n: None,
-                        security_context: get_security_context(element_name, prop_name),
+                        security_context: self.security_context(element_name, prop_name),
                     });
                 } else if attr_name.starts_with('(') && attr_name.ends_with(')') {
                     // Event binding: (event)="handler"
@@ -2909,6 +3022,7 @@ impl<'a> HtmlToR3Transform<'a> {
         &mut self,
         attrs: &[HtmlAttribute<'a>],
         element_name: &str,
+        i18n_element_name: Option<&str>,
         is_template: bool,
     ) -> (
         Vec<'a, R3TextAttribute<'a>>,  // Static attributes
@@ -2932,6 +3046,20 @@ impl<'a> HtmlToR3Transform<'a> {
         for attr in attrs {
             let name = attr.name.as_str();
             if let Some(target_attr) = name.strip_prefix("i18n-") {
+                // `isTrustedTypesSink` lowercases the parser's full name and does
+                // not strip a namespace prefix. `None` is a selectorless component
+                // with no host tag (`tagName === null`), which is not a sink.
+                if i18n_element_name.is_some_and(|element_name| {
+                    is_trusted_types_sink_at(element_name, target_attr, self.angular_version)
+                }) {
+                    self.report_error(
+                        &format!(
+                            "Translating attribute '{target_attr}' is disallowed for security reasons."
+                        ),
+                        attr.span,
+                    );
+                    continue;
+                }
                 let instance_id = self.allocate_i18n_message_instance_id();
                 let meta = parse_i18n_meta(self.allocator, attr.value.as_str(), instance_id);
                 i18n_attrs_meta.insert(target_attr, meta);
@@ -3224,7 +3352,7 @@ impl<'a> HtmlToR3Transform<'a> {
         let name_atom = Ident::from(self.allocator.alloc_str(property_name));
 
         // Look up security context based on element and property
-        let security_context = get_security_context(element_name, property_name);
+        let security_context = self.security_context(element_name, property_name);
 
         R3BoundAttribute {
             name: name_atom,
@@ -4570,7 +4698,7 @@ impl<'a> HtmlToR3Transform<'a> {
         let (binding_type, final_name, unit, security_context) =
             if let Some(stripped) = name.strip_prefix("attr.") {
                 // Attribute bindings use the attribute security context
-                let security_context = get_security_context(element_name, stripped);
+                let security_context = self.security_context(element_name, stripped);
                 (BindingType::Attribute, stripped, None, security_context)
             } else if let Some(stripped) = name.strip_prefix("class.") {
                 (BindingType::Class, stripped, None, SecurityContext::None)
@@ -4585,7 +4713,7 @@ impl<'a> HtmlToR3Transform<'a> {
                 }
             } else {
                 // Property bindings use the property security context
-                let security_context = get_security_context(element_name, name);
+                let security_context = self.security_context(element_name, name);
                 (BindingType::Property, name, None, security_context)
             };
 
@@ -4840,3 +4968,464 @@ pub fn html_ast_to_r3_ast<'a>(
     let transformer = HtmlToR3Transform::new(allocator, source_text, options);
     transformer.transform(html_nodes)
 }
+
+#[cfg(test)]
+mod security_tests {
+    use super::*;
+    use crate::parser::html::HtmlParser;
+    use oxc_allocator::Allocator;
+
+    fn compile(
+        source: &str,
+    ) -> (std::vec::Vec<String>, std::vec::Vec<(String, SecurityContext)>, std::vec::Vec<String>)
+    {
+        compile_at(source, None)
+    }
+
+    fn compile_at(
+        source: &str,
+        angular_version: Option<AngularVersion>,
+    ) -> (std::vec::Vec<String>, std::vec::Vec<(String, SecurityContext)>, std::vec::Vec<String>)
+    {
+        compile_with(source, angular_version, false)
+    }
+
+    fn compile_selectorless(
+        source: &str,
+    ) -> (std::vec::Vec<String>, std::vec::Vec<(String, SecurityContext)>, std::vec::Vec<String>)
+    {
+        compile_with(source, None, true)
+    }
+
+    fn compile_selectorless_at(
+        source: &str,
+        angular_version: Option<AngularVersion>,
+    ) -> (std::vec::Vec<String>, std::vec::Vec<(String, SecurityContext)>, std::vec::Vec<String>)
+    {
+        compile_with(source, angular_version, true)
+    }
+
+    fn compile_with(
+        source: &str,
+        angular_version: Option<AngularVersion>,
+        selectorless: bool,
+    ) -> (std::vec::Vec<String>, std::vec::Vec<(String, SecurityContext)>, std::vec::Vec<String>)
+    {
+        let allocator = Allocator::default();
+        let parsed = if selectorless {
+            HtmlParser::with_selectorless(&allocator, source, "test.html").parse()
+        } else {
+            HtmlParser::new(&allocator, source, "test.html").parse()
+        };
+        let result = html_ast_to_r3_ast(
+            &allocator,
+            source,
+            &parsed.nodes,
+            TransformOptions { angular_version, ..TransformOptions::default() },
+        );
+        let mut names = std::vec::Vec::new();
+        let mut contexts = std::vec::Vec::new();
+        fn walk<'a>(
+            nodes: &[R3Node<'a>],
+            names: &mut std::vec::Vec<String>,
+            contexts: &mut std::vec::Vec<(String, SecurityContext)>,
+        ) {
+            for node in nodes {
+                match node {
+                    R3Node::Element(element) => {
+                        names.push(element.name.as_str().to_string());
+                        for input in &element.inputs {
+                            contexts
+                                .push((input.name.as_str().to_string(), input.security_context));
+                        }
+                        walk(&element.children, names, contexts);
+                    }
+                    R3Node::Component(component) => {
+                        names.push(format!("component:{}", component.component_name.as_str()));
+                        if let Some(tag) = component.tag_name {
+                            names.push(format!("host:{}", tag.as_str()));
+                        }
+                        for input in &component.inputs {
+                            contexts
+                                .push((input.name.as_str().to_string(), input.security_context));
+                        }
+                        walk(&component.children, names, contexts);
+                    }
+                    R3Node::Template(template) => walk(&template.children, names, contexts),
+                    R3Node::Content(content) => walk(&content.children, names, contexts),
+                    _ => {}
+                }
+            }
+        }
+        walk(&result.nodes, &mut names, &mut contexts);
+        let errors = result.errors.iter().map(|err| err.msg.clone()).collect::<std::vec::Vec<_>>();
+        (names, contexts, errors)
+    }
+
+    #[test]
+    fn svg_script_is_stripped_and_animate_to_is_validated() {
+        let (names, contexts, errors) =
+            compile(r#"<svg><script>alert(1)</script><animate [attr.to]="url"></animate></svg>"#);
+        assert!(errors.is_empty(), "{errors:?}");
+        assert!(names.iter().any(|name| name == ":svg:svg" || name == "svg"));
+        assert!(!names.iter().any(|name| name.contains("script")));
+        assert!(names.iter().any(|name| name.contains("animate")));
+        assert!(
+            contexts
+                .iter()
+                .any(|(name, ctx)| name == "to" && *ctx == SecurityContext::AttributeNoBinding),
+            "{names:?} {contexts:?}"
+        );
+    }
+
+    #[test]
+    fn math_href_is_a_url() {
+        let (names, contexts, _) = compile(r#"<math><mi [attr.href]="url"></mi></math>"#);
+        assert!(names.iter().any(|name| name.contains("mi")), "{names:?}");
+        assert!(
+            contexts.iter().any(|(name, ctx)| name == "href" && *ctx == SecurityContext::Url),
+            "{contexts:?}"
+        );
+    }
+
+    #[test]
+    fn iframe_i18n_src_is_rejected() {
+        let (_, _, errors) = compile(r#"<iframe i18n-src src="https://example.com"></iframe>"#);
+        assert!(
+            errors.iter().any(|msg| msg.contains("disallowed for security reasons")),
+            "{errors:?}"
+        );
+    }
+
+    #[test]
+    fn namespaced_iframe_i18n_src_stays_allowed() {
+        let (_, _, errors) =
+            compile(r#"<svg><iframe i18n-src src="https://example.com"></iframe></svg>"#);
+        assert!(!errors.iter().any(|msg| msg.contains("disallowed")), "{errors:?}");
+    }
+
+    #[test]
+    fn v21_keeps_svg_script_and_does_not_validate_namespaced_animate() {
+        let version = Some(AngularVersion::new(21, 2, 7));
+        let (names, contexts, _) = compile_at(
+            r#"<svg><script>alert(1)</script><animate [attr.to]="url"></animate></svg>"#,
+            version,
+        );
+        assert!(names.iter().any(|name| name.contains("script")), "{names:?}");
+        assert!(
+            contexts.iter().any(|(name, ctx)| name == "to" && *ctx == SecurityContext::None),
+            "{contexts:?}"
+        );
+    }
+
+    #[test]
+    fn xml_script_is_kept_and_xml_iframe_src_stays_translatable() {
+        let (names, _, _) = compile(r#"<xml:script>alert(1)</xml:script>"#);
+        assert!(names.iter().any(|name| name.contains("script")), "{names:?}");
+        let (_, _, errors) =
+            compile(r#"<xml:iframe i18n-src src="https://example.com"></xml:iframe>"#);
+        assert!(!errors.iter().any(|msg| msg.contains("disallowed")), "{errors:?}");
+    }
+
+    #[test]
+    fn v21_2_3_allows_iframe_src_translation() {
+        let (_, _, errors) = compile_at(
+            r#"<iframe i18n-src src="https://example.com"></iframe>"#,
+            Some(AngularVersion::new(21, 2, 3)),
+        );
+        assert!(!errors.iter().any(|msg| msg.contains("disallowed")), "{errors:?}");
+    }
+
+    #[test]
+    fn selectorless_iframe_host_rejects_i18n_src() {
+        let (_, _, errors) = compile_selectorless(
+            r#"<MyComp:iframe i18n-src src="https://example.com"></MyComp:iframe>"#,
+        );
+        assert!(
+            errors.iter().any(|msg| msg.contains("disallowed for security reasons")),
+            "{errors:?}"
+        );
+    }
+
+    #[test]
+    fn selectorless_svg_iframe_host_is_not_the_iframe_sink() {
+        let (_, _, errors) = compile_selectorless(
+            r#"<MyComp:svg:iframe i18n-src src="https://example.com"></MyComp:svg:iframe>"#,
+        );
+        assert!(!errors.iter().any(|msg| msg.contains("disallowed")), "{errors:?}");
+    }
+
+    #[test]
+    fn selectorless_without_host_tag_is_not_a_sink() {
+        let (_, _, errors) =
+            compile_selectorless(r#"<MyComp i18n-innerHTML innerHTML="<b>x</b>"></MyComp>"#);
+        assert!(!errors.iter().any(|msg| msg.contains("disallowed")), "{errors:?}");
+    }
+
+    #[test]
+    fn selectorless_script_class_is_kept_and_script_host_is_rejected() {
+        let (names, _, errors) = compile_selectorless(r#"<Script>alert(1)</Script>"#);
+        assert!(errors.is_empty(), "{errors:?}");
+        assert!(names.iter().any(|name| name == "component:Script"), "{names:?}");
+
+        let (names, _, errors) = compile_selectorless(
+            r#"<Script:iframe i18n-src src="https://example.com"></Script:iframe>"#,
+        );
+        assert!(
+            errors.iter().any(|msg| msg.contains("disallowed for security reasons")),
+            "{errors:?} {names:?}"
+        );
+        assert!(names.iter().any(|name| name == "component:Script"), "{names:?}");
+
+        let (_, _, errors) = compile_selectorless(r#"<MyComp:script></MyComp:script>"#);
+        assert!(
+            errors
+                .iter()
+                .any(|msg| msg.contains("Tag name \"script\" cannot be used as a component tag")),
+            "{errors:?}"
+        );
+    }
+
+    #[test]
+    fn element_script_class_is_still_stripped() {
+        let (names, _, _) = compile(r#"<Script>alert(1)</Script>"#);
+        assert!(
+            !names.iter().any(|name| name.to_ascii_lowercase().contains("script")),
+            "{names:?}"
+        );
+    }
+
+    #[test]
+    fn selectorless_inside_svg_inherits_the_namespace() {
+        let (_, _, errors) = compile_selectorless(
+            r#"<svg><MyComp i18n-innerHTML innerHTML="<b>x</b>"></MyComp></svg>"#,
+        );
+        assert!(
+            errors.iter().any(|msg| msg.contains("disallowed for security reasons")),
+            "{errors:?}"
+        );
+
+        let (_, _, errors) = compile_selectorless(
+            r#"<svg><MyComp:iframe i18n-src src="https://example.com"></MyComp:iframe></svg>"#,
+        );
+        assert!(!errors.iter().any(|msg| msg.contains("disallowed")), "{errors:?}");
+
+        let (names, _, errors) =
+            compile_selectorless(r#"<svg><MyComp:script></MyComp:script></svg>"#);
+        assert!(
+            !errors.iter().any(|msg| msg.contains("cannot be used as a component tag")),
+            "{errors:?}"
+        );
+        assert!(names.iter().any(|name| name == "component:MyComp"), "{names:?}");
+
+        let (_, _, errors) = compile_selectorless(
+            r#"<math><MyComp i18n-innerHTML innerHTML="<b>x</b>"></MyComp></math>"#,
+        );
+        assert!(
+            errors.iter().any(|msg| msg.contains("disallowed for security reasons")),
+            "{errors:?}"
+        );
+    }
+
+    #[test]
+    fn selectorless_inside_foreign_object_does_not_inherit_svg() {
+        let (_, _, errors) = compile_selectorless(
+            r#"<svg><foreignObject><MyComp i18n-innerHTML innerHTML="<b>x</b>"></MyComp></foreignObject></svg>"#,
+        );
+        assert!(!errors.iter().any(|msg| msg.contains("disallowed")), "{errors:?}");
+
+        let (_, _, errors) = compile_selectorless(
+            r#"<svg><foreignObject><MyComp:iframe i18n-src src="https://example.com"></MyComp:iframe></foreignObject></svg>"#,
+        );
+        assert!(
+            errors.iter().any(|msg| msg.contains("disallowed for security reasons")),
+            "{errors:?}"
+        );
+    }
+
+    #[test]
+    fn selectorless_iframe_src_i18n_follows_version() {
+        let (_, _, errors) = compile_selectorless_at(
+            r#"<MyComp:iframe i18n-src src="https://example.com"></MyComp:iframe>"#,
+            Some(AngularVersion::new(21, 2, 3)),
+        );
+        assert!(!errors.iter().any(|msg| msg.contains("disallowed")), "{errors:?}");
+    }
+
+    #[test]
+    fn selectorless_binding_security_uses_the_host_tag() {
+        // `iframe|src` is a resource URL on the resolved host tag.
+        let (_, contexts, _) =
+            compile_selectorless(r#"<MyComp:iframe [src]="url"></MyComp:iframe>"#);
+        assert!(
+            contexts
+                .iter()
+                .any(|(name, ctx)| name == "src" && *ctx == SecurityContext::ResourceUrl),
+            "{contexts:?}"
+        );
+
+        // The `:svg:` host hits the namespaced animation schema.
+        let (_, contexts, _) =
+            compile_selectorless(r#"<MyComp:svg:animate [attr.to]="v"></MyComp:svg:animate>"#);
+        assert!(
+            contexts
+                .iter()
+                .any(|(name, ctx)| name == "to" && *ctx == SecurityContext::AttributeNoBinding),
+            "{contexts:?}"
+        );
+
+        // A namespaced host does not fall back to the bare iframe sink.
+        let (_, contexts, _) =
+            compile_selectorless(r#"<MyComp:svg:iframe [src]="url"></MyComp:svg:iframe>"#);
+        assert!(
+            contexts.iter().all(|(name, ctx)| name != "src" || *ctx == SecurityContext::None),
+            "{contexts:?}"
+        );
+
+        // `tagName === null` resolves over every element: `*|innerHTML`.
+        let (_, contexts, _) = compile_selectorless(r#"<MyComp [innerHTML]="html"></MyComp>"#);
+        assert!(
+            contexts.iter().any(|(name, ctx)| name == "innerHTML" && *ctx == SecurityContext::Html),
+            "{contexts:?}"
+        );
+    }
+
+    #[test]
+    fn prefixed_element_does_not_inherit_the_parent_namespace_for_security() {
+        // `normalizeTagName` drops a non-svg/math prefix, so `<xml:iframe>`
+        // inside `<svg>` still requires the resource-URL sanitizer.
+        let (_, contexts, _) = compile(r#"<svg><xml:iframe [src]="url"></xml:iframe></svg>"#);
+        assert!(
+            contexts
+                .iter()
+                .any(|(name, ctx)| name == "src" && *ctx == SecurityContext::ResourceUrl),
+            "{contexts:?}"
+        );
+    }
+
+    #[test]
+    fn children_inherit_an_arbitrary_prefix() {
+        // `_getPrefix` inherits `getNsPrefix(parentName)` verbatim, so `<iframe>`
+        // inside `<xml:div>` resolves to `:xml:iframe`. `normalizeTagName` drops
+        // the `xml` prefix and the `iframe|src` resource-URL sanitizer applies.
+        let (names, contexts, _) =
+            compile(r#"<svg><xml:div><iframe [src]="url"></iframe></xml:div></svg>"#);
+        assert!(names.iter().any(|name| name == ":xml:iframe"), "{names:?}");
+        assert!(
+            contexts
+                .iter()
+                .any(|(name, ctx)| name == "src" && *ctx == SecurityContext::ResourceUrl),
+            "{names:?} {contexts:?}"
+        );
+
+        // The same inheritance drives selectorless host tags (`tagName`).
+        let (names, _, _) =
+            compile_selectorless(r#"<xml:div><MyComp [innerHTML]="html"></MyComp></xml:div>"#);
+        assert!(names.iter().any(|name| name == "host::xml:ng-component"), "{names:?}");
+    }
+
+    #[test]
+    fn selectorless_children_inherit_the_host_tag_namespace() {
+        // Children of `<MyComp:math>` are MathML: `mi` is only an href sink in
+        // the `:math:` namespace.
+        let (_, contexts, _) =
+            compile_selectorless(r#"<MyComp:math><mi [href]="url"></mi></MyComp:math>"#);
+        assert!(
+            contexts.iter().any(|(name, ctx)| name == "href" && *ctx == SecurityContext::Url),
+            "{contexts:?}"
+        );
+
+        // `foreignObject` prevents namespace inheritance, so children of
+        // `<MyComp:foreignObject>` inside `<svg>` are HTML again.
+        let (_, contexts, _) = compile_selectorless(
+            r#"<svg><MyComp:foreignObject><iframe [src]="url"></iframe></MyComp:foreignObject></svg>"#,
+        );
+        assert!(
+            contexts
+                .iter()
+                .any(|(name, ctx)| name == "src" && *ctx == SecurityContext::ResourceUrl),
+            "{contexts:?}"
+        );
+
+        // `<MyComp>` inside `<svg>` resolves to `:svg:ng-component`, so its
+        // children stay namespaced.
+        let (_, contexts, _) =
+            compile_selectorless(r#"<svg><MyComp><iframe [src]="url"></iframe></MyComp></svg>"#);
+        assert!(
+            contexts.iter().all(|(name, ctx)| name != "src" || *ctx == SecurityContext::None),
+            "{contexts:?}"
+        );
+
+        // At the HTML root `tagName === null`: children are plain HTML.
+        let (_, contexts, _) =
+            compile_selectorless(r#"<MyComp><iframe [src]="url"></iframe></MyComp>"#);
+        assert!(
+            contexts
+                .iter()
+                .any(|(name, ctx)| name == "src" && *ctx == SecurityContext::ResourceUrl),
+            "{contexts:?}"
+        );
+    }
+
+    #[test]
+    fn selectorless_bare_host_stays_bare_before_the_namespaced_schema() {
+        // Pre-v22 `calcPossibleSecurityContexts` looks the bare tag up:
+        // `animate|to` is `AttributeNoBinding` on 21.2.7 while `:svg:animate|to`
+        // is not a key.
+        let (_, contexts, _) = compile_selectorless_at(
+            r#"<MyComp:animate [attr.to]="value"></MyComp:animate>"#,
+            Some(AngularVersion::new(21, 2, 7)),
+        );
+        assert!(
+            contexts
+                .iter()
+                .any(|(name, ctx)| name == "to" && *ctx == SecurityContext::AttributeNoBinding),
+            "{contexts:?}"
+        );
+
+        // Same for bare MathML hosts: `mi|href` is a bare URL key pre-v22.
+        let (_, contexts, _) = compile_selectorless_at(
+            r#"<MyComp:mi [attr.href]="value"></MyComp:mi>"#,
+            Some(AngularVersion::new(21, 2, 7)),
+        );
+        assert!(
+            contexts.iter().any(|(name, ctx)| name == "href" && *ctx == SecurityContext::Url),
+            "{contexts:?}"
+        );
+
+        // v22 promotes the bare host to `:svg:animate` like upstream.
+        let (_, contexts, _) =
+            compile_selectorless(r#"<MyComp:animate [attr.to]="value"></MyComp:animate>"#);
+        assert!(
+            contexts
+                .iter()
+                .any(|(name, ctx)| name == "to" && *ctx == SecurityContext::AttributeNoBinding),
+            "{contexts:?}"
+        );
+    }
+
+    #[test]
+    fn prefixed_element_lookup_matches_the_versions_normalize_tag_name() {
+        // `normalizeTagName` in `securityContext` only exists at 19.2.23 /
+        // 20.3.22 / 21.2.15 and later. Before that the tag is lowercased
+        // verbatim, so `:xml:iframe|src` is not the `iframe|src` sink.
+        for (major, minor, patch, expected) in [
+            (21, 2, 13, SecurityContext::None),
+            (21, 2, 14, SecurityContext::None),
+            (21, 2, 15, SecurityContext::ResourceUrl),
+            (19, 2, 22, SecurityContext::None),
+            (19, 2, 23, SecurityContext::ResourceUrl),
+            (20, 3, 21, SecurityContext::None),
+            (20, 3, 22, SecurityContext::ResourceUrl),
+        ] {
+            let (_, contexts, _) = compile_at(
+                r#"<xml:iframe [src]="url"></xml:iframe>"#,
+                Some(AngularVersion::new(major, minor, patch)),
+            );
+            assert!(
+                contexts.iter().any(|(name, ctx)| name == "src" && *ctx == expected),
+                "v{major}.{minor}.{patch}: {contexts:?}"
+            );
+        }
+    }
+}
diff --git a/crates/oxc_angular_compiler/tests/integration_test.rs b/crates/oxc_angular_compiler/tests/integration_test.rs
index d20838aa3..7ad1ef87e 100644
--- a/crates/oxc_angular_compiler/tests/integration_test.rs
+++ b/crates/oxc_angular_compiler/tests/integration_test.rs
@@ -41,7 +41,11 @@ fn compile_template_to_js_with_version(
     }
 
     // Stage 2: Transform HTML AST to R3 AST
-    let transformer = HtmlToR3Transform::new(&allocator, template, TransformOptions::default());
+    let transformer = HtmlToR3Transform::new(
+        &allocator,
+        template,
+        TransformOptions { angular_version, ..TransformOptions::default() },
+    );
     let r3_result = transformer.transform(&html_result.nodes);
 
     // Check for transform errors
@@ -10337,6 +10341,61 @@ fn test_property_singleton_interpolation_with_sanitizer_angular_v19() {
     insta::assert_snapshot!("property_singleton_interpolation_with_sanitizer_v19", js);
 }
 
+#[test]
+fn test_iframe_sensitive_attr_validation_legacy_versions() {
+    // Upstream resolve_sanitizers.ts falls back to ɵɵvalidateIframeAttribute for
+    // security-sensitive iframe attributes that got no sanitizer. It existed on
+    // versions before the iframe attributeNoBinding schema keys (removed in
+    // 19.2.17 / 20.3.15 / 21.0.2).
+    for version in [AngularVersion::new(19, 0, 0), AngularVersion::new(21, 0, 1)] {
+        let js = compile_template_to_js_with_version(
+            r#"<iframe [sandbox]="expr"></iframe>"#,
+            "TestComponent",
+            Some(version),
+        );
+        assert!(
+            js.contains("ɵɵvalidateIframeAttribute"),
+            "v{version:?} should emit ɵɵvalidateIframeAttribute for iframe [sandbox]. Got:\n{js}"
+        );
+    }
+    // Once the schema covers iframe|sandbox as attributeNoBinding, the generic
+    // ɵɵvalidateAttribute is used instead.
+    for version in [AngularVersion::new(19, 2, 17), AngularVersion::new(21, 0, 2)] {
+        let js = compile_template_to_js_with_version(
+            r#"<iframe [sandbox]="expr"></iframe>"#,
+            "TestComponent",
+            Some(version),
+        );
+        assert!(
+            js.contains("ɵɵvalidateAttribute"),
+            "v{version:?} should emit ɵɵvalidateAttribute for iframe [sandbox]. Got:\n{js}"
+        );
+        assert!(
+            !js.contains("ɵɵvalidateIframeAttribute"),
+            "v{version:?} should not emit the legacy iframe validator. Got:\n{js}"
+        );
+    }
+    // The validator only applies to iframes and only to the sensitive attrs.
+    let js = compile_template_to_js_with_version(
+        r#"<div [sandbox]="expr"></div>"#,
+        "TestComponent",
+        Some(AngularVersion::new(21, 0, 1)),
+    );
+    assert!(
+        !js.contains("ɵɵvalidateIframeAttribute"),
+        "Non-iframe host should not get the iframe validator. Got:\n{js}"
+    );
+    let js = compile_template_to_js_with_version(
+        r#"<iframe [title]="expr"></iframe>"#,
+        "TestComponent",
+        Some(AngularVersion::new(21, 0, 1)),
+    );
+    assert!(
+        !js.contains("ɵɵvalidateIframeAttribute"),
+        "Non-sensitive attribute should not get the iframe validator. Got:\n{js}"
+    );
+}
+
 // ============================================================================
 // Host Directive Alias Tests
 // ============================================================================
diff --git a/crates/oxc_angular_compiler/tests/r3_template_transform_test.rs b/crates/oxc_angular_compiler/tests/r3_template_transform_test.rs
index de6102647..65f2c0078 100644
--- a/crates/oxc_angular_compiler/tests/r3_template_transform_test.rs
+++ b/crates/oxc_angular_compiler/tests/r3_template_transform_test.rs
@@ -394,7 +394,8 @@ fn parse_internal(
         html_result.errors.iter().map(|e| &e.msg).collect::<Vec<_>>()
     );
 
-    let options = TransformOptions { collect_comment_nodes: collect_comments };
+    let options =
+        TransformOptions { collect_comment_nodes: collect_comments, ..Default::default() };
     let transformer = HtmlToR3Transform::new(allocator_ref, html, options);
     let r3_result = transformer.transform(&html_result.nodes);
 
@@ -758,7 +759,7 @@ fn get_transform_errors(html: &str) -> Vec<String> {
     let parser = HtmlParser::new(allocator_ref, html, "test.html");
     let html_result = parser.parse();
 
-    let options = TransformOptions { collect_comment_nodes: false };
+    let options = TransformOptions { collect_comment_nodes: false, ..Default::default() };
     let transformer = HtmlToR3Transform::new(allocator_ref, html, options);
     let r3_result = transformer.transform(&html_result.nodes);
 
@@ -2340,7 +2341,7 @@ mod switch_invalid_case_unknown_blocks {
         let parser = HtmlParser::new(allocator_ref, html, "test.html");
         let html_result = parser.parse();
 
-        let options = TransformOptions { collect_comment_nodes: false };
+        let options = TransformOptions { collect_comment_nodes: false, ..Default::default() };
         let transformer = HtmlToR3Transform::new(allocator_ref, html, options);
         let r3_result = transformer.transform(&html_result.nodes);